Loading npm security reports…

@musteqeem/baileys@1.0.3: Malicious npm security report (Block) | LPM Firewall

registry / @musteqeem/baileys / 1.0.3

@musteqeem/baileys@1.0.3

֎ XADON BAILEYS v7.1.0 PREMIUM - Next-generation WhatsApp Web API library. Engineered with enterprise-grade stability, critical newsletter media upload fixes, full interactive message protocol, native album support, and 40+ extended message types. Built f

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Sending an image or video through the library automatically attaches package-defined newsletter metadata. This changes outgoing user content without an opt-in.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Runtime call that prepares an image or video message

Impact

Unconsented attribution or forwarding metadata is sent with user media.

Mechanism

automatic injection of preset newsletter annotation

Attack narrative

At runtime, prepareWAMessageMedia assigns a module-level mediaAnnotation whenever the requested message contains an image or video. That annotation carries a newsletter object whose defaults are embedded in the package, while environment variables can override them. This is concealed message-content modification rather than a requested media-processing feature. The install hook itself is only a Node-version check.

Rationale

The package contains concrete, automatic, unconsented mutation of outgoing user media metadata. Although the lifecycle hook is benign and no host credential theft was found, the hidden attribution behavior is sufficient to block.

Evidence

lib/Utils/messages.jsengine-requirements.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5250233 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @musteqeem/baileys@1.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QG11c3RlcWVlbS9iYWlsZXlz:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 1-29json

1{

2 "name": "@musteqeem/baileys",

3 "version": "1.0.3",

4 "description": "֎ XADON BAILEYS v7.1.0 PREMIUM - Next-generation WhatsApp Web API library. Engineered with enterprise-grade stability, critical newsletter media upload fixes, full interactive message protocol, native album support, and 40+ extended message types. Built for high-performance bots, zero downtime, and maximum anti-ban resilience. The new industry standard.",

5 "main": "lib/index.js",

6 "types": "lib/index.d.ts",

7 "type": "module",

8 "scripts": {

9 "preinstall": "node ./engine-requirements.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 },

11 "engines": {

12 "node": ">=20.0.0"

13 },

14 "repository": {

15 "type": "git",

16 "url": "git+https://github.com/musteqeem/baileys.git"

17 },

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "keywords": [

24 "meta",

25 "xadon",

26 "xadon-baileys",

27 "anti-ban",

28 "automation",

29 "baileys",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

91

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5250233 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @musteqeem/baileys@1.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QG11c3RlcWVlbS9iYWlsZXlz:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg