@modss/baileys@1.0.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@modss/baileys@1.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./postinstall-banner.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•Runtime dependency names matching Node built-ins: fs, os, path, readline

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

601patternName = google_api_key severity = high line = 601

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L601

601patternName = google_api_key severity = high line = 601

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L601

lib/Utils/crypto.jsView file

1//=======================================================// L2: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto"; L3: import { KEY_BUNDLE_TYPE } from "../Defaults/index.js"; ... L11: return { L12: private: Buffer.from(privKey), L13: public: Buffer.from(pubKey.slice(1))

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4263226 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @fyxzpediaa/baileys@8.1.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGZ5eHpwZWRpYWEvYmFpbGV5cw:8.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 9-51json

9 "nodejs",

10 "baileys",

11 "wabot",

12 "proto",

13 "whatsapp-websocket"

14 ],

15 "homepage": "https://github.com/Dayyy-19/Baileys",

16 "repository": {

17 "type": "git",

18 "url": "git+ssh://git@github.com/Dayyy-19/Baileys.git"

19 },

20 "license": "MIT",

21 "author": "Dayyy",

22 "main": "./lib/index.js",

23 "files": [

24 "lib/*",

25 "WAProto/*",

26 "engine-requirements.js",

27 "postinstall-banner.js"

28 ],

29 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L29

30 "preinstall": "node ./engine-requirements.js",

31 "postinstall": "node ./postinstall-banner.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

33 "changelog:preview": "conventional-changelog -p angular -u",

34 "changelog:last": "conventional-changelog -p angular -r 2",

35 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

36 "example": "node --inspect Example/example.js",

37 "lint": "eslint src --ext .js",

38 "lint:fix": "yarn lint --fix",

39 "release": "release-it",

40 "test": "jest"

41 },

42 "dependencies": {

43 "@cacheable/node-cache": "*",

44 "@modss/libsignal": "^1.0.0",

45 "@hapi/boom": "*",

46 "@whiskeysockets/eslint-config": "github:whiskeysockets/eslint-config",

47 "async-mutex": "*",

48 "axios": "*",

49 "cache-manager": "*",

50 "figlet": "*",

51 "fs": "*",

lib/WABinary/constants.jsView file

Lines 581-621javascript

581 "044",

582 "mms_cat_v1_forward_hot_override_enabled",

583 "user_notice",

584 "ptt_waveform_send",

585 "047",

586 "Asia/Calcutta",

587

lib/Utils/crypto.jsView file

Lines 1-21javascript

1//=======================================================//

2import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";

3import { KEY_BUNDLE_TYPE } from "../Defaults/index.js";

4import * as curve from "@modss/libsignal/src/curve.js";

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4263226 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @fyxzpediaa/baileys@8.1.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGZ5eHpwZWRpYWEvYmFpbGV5cw:8.1.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg