registry  /  @kyyinfinite/baileys  /  0.1.1

@kyyinfinite/baileys@0.1.1

Modded Baileys v1 with interactive message, album, and newsletter support

Static Scan Results

scanned 13m ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
Manifest
GitDependency
scanned 101 file(s), 1.74 MB of source, external domains: call.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, web.whatsapp.com, www.whatsapp.com
Oversized source lightweight scan
WAProto/index.js6.35 MB file, sampled 256 KB
ChildProcess

Source & flagged code

7 flagged · loading source
lib/WABinary/constants.jsView file
600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',
High
High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600
600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',
High
Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600
lib/Utils/validate-connection.jsView file
104pull: false, L105: devicePairingData: { L106: buildHash: appVersionBuf, ... L131: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L132: let hmacPrefix = Buffer.from([]); L133: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L155: ]); L156: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L157: const identity = createSignalIdentity(lid, accountSignatureKey);
Low
Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L104
WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg
WAProto/index.jsView file
•path = WAProto/index.js kind = oversized_source_file sizeBytes = 6656208 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg
package.jsonView file
•dependencies changed=libsignal
Critical
Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg
lib/WABinary/constants.d.tsView file
20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];
High
Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Findings

1 Critical4 High4 Medium5 Low
CriticalManifest Confusionpackage.json
HighHigh Secretlib/WABinary/constants.js
HighOversized Source FileWAProto/index.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings