registry / @kelvdra/baileys / 1.0.6-rc.3

@kelvdra/baileys@1.0.6-rc.3

Baileys fork whiskeysockets modified by kelvdra.

AI Security Review

scanned 57m ago · by lpm-firewall-ai

A caller-supplied motion-video URL is interpolated into a shell command. A crafted URL can alter that command when the feature extracts a frame.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller invokes the motion-video handler with an HTTP or HTTPS video URL.

Impact

Command injection may allow arbitrary command execution in the application process.

Mechanism

The URL is inserted into a command string and passed to `child_process.exec` without shell-safe argument handling.

AI rationale

Static source inspection found an unsafely interpolated, caller-controlled URL passed to a shell through `exec` in the motion-video feature. This is a concrete command-injection vulnerability, so the package warrants a warning rather than a malicious verdict.

Evidence

lib/Socket/hydra.js

Decision evidence

public snapshot

AI called this Suspicious at 98.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

In `lib/Socket/hydra.js`, the motion handler takes a video URL from caller-supplied content and passes it to `_extractVideoFrame`.
`_extractVideoFrame` interpolates that URL into a shell command and executes it with `child_process.exec`, creating a command-injection path when a crafted URL reaches this caller-invoked feature.

@kelvdra/baileys@1.0.6-rc.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code