registry / @kxa/xbails / 0.0.7

@kxa/xbails@0.0.7

⚠ Under review

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 137 file(s), 2.16 MB of source, external domains: acs.whatsapp.com, api.telegram.org, call.whatsapp.com, graph.whatsapp.com, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js7.73 MB file, sampled 256 KB

No sampled risky behavior triggered.

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/antiban.cjsView file

1const __importMetaUrl = require('url').pathToFileURL(__filename).href L2: ;('use strict')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/antiban.cjsView on unpkg · L1

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8100533 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/antiban.cjs

Findings

4 High6 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighSemantic Analysis LimitedWAProto/index.js

HighSecret Patternlib/WABinary/constants.js

MediumDynamic Requirelib/antiban.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build HelperWAProto/GenerateStatics.sh

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

Affected versions and remediation

This report applies to @kxa/xbails@0.0.7.

See version security history for other recorded verdicts.

Review the evidence and your use of @kxa/xbails@0.0.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-03 12:01:44.011Z (UTC).