@kelvdra/baileys: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@kelvdra/baileys: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/VoIP/worker-bootstrap.jsView file

342const code = fs.readFileSync(url, "utf8"); L343: eval(code); L344: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/VoIP/worker-bootstrap.jsView on unpkg · L342

lib/Utils/auth-store.jsView file

18try { L19: const mod = await import(name); L20: return mod.default ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/auth-store.jsView on unpkg · L18

lib/VoIP/wasm-engine.jsView file

13import { fileURLToPath } from 'node:url'; L14: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L15: const CALL_WASM_AB_PROPS_JSON = process.env.CALL_WASM_AB_PROPS_JSON ?? ""; L16: const PTHREAD_POOL_SIZE = 20; ... L21: try { L22: const parsed = JSON.parse(raw); L23: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) ... L47: }; L48: const filterWorkerStderr = (chunk) => { L49: const line = chunk.toString().trim(); L50: if (line && !line.startsWith("voip:") && !line.startsWith("still waiting")) { L51: process.stderr.write(chunk);

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/VoIP/wasm-engine.jsView on unpkg · L13

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5606768 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Source & flagged code

10 flagged

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

588 '31',

589 '29',

590 '128',

591 'md_messaging_enabled',

592 '046',

593 'crypto',

594 '690',

595 '045',

596 'enc_iv',

597 '75',

598 'failure',

599 'ptt_oot_playback',

600 'AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

601 'w',

602 '048',

603 '2201',

604 'web_large_files_ui',

605 'Asia/Makassar',

606 '812',

607 'status_collapse_muted',

608 '1334',

609 '257',

610 '2HP4dm',

611 '049',

612 'patches',

613 '1290',

614 '43cY6T',

615 'America/Caracas',

616 'web_sticker_maker',

617 'campaign',

618 'ptt_pausable_enabled',

619 '33',

620 '42',

lib/VoIP/worker-bootstrap.jsView file

Lines 322-362javascript

322__modules["Promise"] = { exports: Promise };

323const bxFunc = function (id) { return id; };

324bxFunc.getURL = function

lib/Utils/auth-store.jsView file

Lines 1-38javascript

1/* @kelvdra/baileys distribution. */

2import { proto } from '../../WAProto/index.js';

3import { initAuthCreds } from './auth-utils.js';

4import { BufferJSON } from './generics.js';

5export const

lib/VoIP/wasm-engine.jsView file

Lines 1-33javascript

1/**

2 * VoIP calling stack for @kelvdra/baileys.

3 *

4 * Derives from ShellTear's `baileys-caller`, which first showed that the WhatsApp Web

5 * VoIP WASM engine can be driven from Node. Video calls, screen share, playlists,

6 */

7import * as vm from 'node:vm';

8

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

91

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5606768 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: