registry / Malware / @lordmega/baileys

@lordmega/baileys

Enhanced Baileys v7 with fixes for newsletter media uploads, plus support for interactive messages, albums, and additional message types.

This report shows the evidence for @lordmega/baileys@0.3.40. 1 of 11 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The benign engine check does not explain the obfuscated runtime mutation. Concealed third-party branding injected into user messages is concrete, non-consensual payload manipulation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer calls the package's media-message preparation path with the matching media options.

Impact

User-created media messages can carry undisclosed third-party newsletter branding or attribution.

Mechanism

Obfuscated insertion of branded newsletter metadata into outgoing media

Attack narrative

On import, the obfuscated message module initializes concealed newsletter brand values protected by an integrity hash. During media-message construction it builds a newsletter annotation and conditionally assigns it into the outgoing message object. This causes an unrelated package to alter users' WhatsApp media payloads with undisclosed third-party branding; the value concealment makes the behavior difficult for consumers to audit.

AI rationale

The benign engine check does not explain the obfuscated runtime mutation. Concealed third-party branding injected into user messages is concrete, non-consensual payload manipulation.

Evidence

lib/Utils/messages.jslib/Defaults/index.jspackage.jsonengine-requirements.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

lib/Utils/messages.js is deliberately obfuscated and initializes hidden brand constants at import.
The obfuscated module constructs newsletter metadata in mediaAnnotation.
Media-message preparation conditionally assigns mediaAnnotation to outgoing media.
The package identity differs from embedded defaults identifying itsliaaa/baileys.

Evidence against

The preinstall hook only enforces Node.js 20+ and performs no network or file mutation.
Reviewed network code is WhatsApp/media functionality; no credential harvesting or shell payload execution was found.

Behavioral surface

Source

ChildProcessCryptoFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 123 file(s), 2.01 MB of source, external domains: acs.whatsapp.com, call.whatsapp.com, graph.whatsapp.com, raw.githubusercontent.com, saweria.co, stackoverflow.com, wa.me, web.whatsapp.com, www.whatsapp.com

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = token_shingles matchedPackage = @crysnovax/baileys@2.7.12 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:QGNyeXNub3ZheC9iYWlsZXlz:2.7.12 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/validate-connection.jsView file

114pull: false, L115: devicePairingData: { L116: buildHash: appVersionBuf, ... L141: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L142: let hmacPrefix = Buffer.from([]); L143: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L165: ]); L166: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L167: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L114

lib/Utils/messages.jsView file

1const _0x4c4914=_0x4432;(function(_0x570432,_0xbf376d){const _0x1ab300=_0x4432,_0x44c28a=_0x570432();while(!![]){try{const _0x26cac9=-parseInt(_0x1ab300(0x24b))/0x1*(-parseInt(_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/Utils/messages.jsView on unpkg · L1

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5329879 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

Findings

7 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighObfuscated Payload Loaderlib/Utils/messages.js

HighObfuscated

HighSemantic Analysis Limitedlib/Utils/business.js

HighKnown Malware Source Similaritylib/WABinary/constants.js

HighSecret Patternlib/WABinary/constants.js

MediumNetwork

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to @lordmega/baileys@0.3.40.

The versions list below shows the verdict for each recorded version.

Avoid installing @lordmega/baileys@0.3.40. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-21 23:04:43.549Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

11 known versions

0.0.1-securitylatestClean—AllowPublishedAug 26, 2026, 1:48 PM 0.3.41SuspiciousMalwareWarnPublishedAug 22, 2026, 4:24 PM 0.3.40shownMaliciousMalwareBlockPublishedAug 21, 2026, 10:55 PM 0.3.35Clean—AllowPublishedAug 21, 2026, 12:27 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code