@musteqeem/baileys@1.0.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@musteqeem/baileys@1.0.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5250233 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @musteqeem/baileys@1.0.7 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QG11c3RlcWVlbS9iYWlsZXlz:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @musteqeem/baileys@1.0.5 matchedIdentity = npm:QG11c3RlcWVlbS9iYWlsZXlz:1.0.5 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@musteqeem/baileys",

3 "version": "1.0.0",

4 "description": "Enhanced Baileys v7 with fixed newsletter media upload, plus support for interactive messages, albums, and more message types.",

5 "main": "lib/index.js",

6 "types": "lib/index.d.ts",

7 "type": "module",

8 "scripts": {

9 "preinstall": "node ./engine-requirements.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 },

11 "engines": {

12 "node": ">=20.0.0"

13 },

14 "repository": {

15 "type": "git",

16 "url": "git+https://github.com/musteqeem/baileys.git"

17 },

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "keywords": [

24 "automation",

25 "baileys",

26 "baileys-fork",

27 "baileys-mod",

28 "interactive-messages",

29 "js-whatsapp",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

91

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5250233 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @musteqeem/baileys@1.0.7 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QG11c3RlcWVlbS9iYWlsZXlz:1.0.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @musteqeem/baileys@1.0.5 matchedIdentity = npm:QG11c3RlcWVlbS9iYWlsZXlz:1.0.5 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg