@lsqltmux-code/baileys@9.0.0
WhatsApp API Modification By Lsqltmux-Code
AI Security Review
scanned 8d ago · by lpm-firewall-aiNormal socket creation triggers delayed FOLLOW actions against publisher-selected newsletter IDs. This is concrete unauthorized account behavior, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer creates the package's socket; the first follow is scheduled after ten seconds, with later follows scheduled in sequence.
Impact
The authenticated account can be subscribed to newsletters the user did not choose.
Mechanism
The newsletter socket decodes hard-coded newsletter IDs and sends WhatsApp protocol queries using the FOLLOW action, without requiring a caller-selected target.
Attack narrative
The package's exported socket factory reaches the newsletter socket during normal initialization. That factory schedules WhatsApp FOLLOW queries for three hard-coded newsletter IDs, without user selection or a consent check, changing the authenticated account's subscriptions.
AI rationale
Normal socket creation triggers delayed FOLLOW actions against publisher-selected newsletter IDs. This is concrete unauthorized account behavior, so the package should be blocked.
Evidence
package.jsonlib/index.jslib/Socket/index.jslib/Socket/communities.jslib/Socket/business.jslib/Socket/messages-recv.jslib/Socket/messages-send.jslib/Socket/newsletter.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports a socket factory that builds the newsletter socket as part of normal socket initialization.
- The newsletter code schedules FOLLOW queries for three hard-coded newsletter IDs without checking for a user-selected target.
- Those queries use the WhatsApp protocol, so initializing the socket can subscribe the authenticated account to publisher-selected newsletters.
Evidence against
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js11.6 MB file, sampled 256 KB
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/fix-import.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
Affected versions and remediation
This report applies to @lsqltmux-code/baileys@9.0.0.
See all versions of @lsqltmux-code/baileys for other recorded verdicts.
- Avoid installing @lsqltmux-code/baileys@9.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.