registry / @neoxr/zapo / 1.0.4
@neoxr/zapo@1.0.4
TypeScript connector for building WhatsApp Bot (ZapoJS)
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe entrypoint loads heavily obfuscated code, and the connection module uses dynamic function construction. Because the behavior is unresolved, classify this as suspicious and warn; the inspected source does not prove a concrete attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package through lib/index.js.
Impact
Unknown; the inspected evidence does not establish a specific harmful effect.
Mechanism
The entrypoint loads obfuscated security and connection modules; the connection module constructs code dynamically.
AI rationale
The entrypoint loads heavily obfuscated code, and the connection module uses dynamic function construction. Because the behavior is unresolved, classify this as suspicious and warn; the inspected source does not prove a concrete attack.
Evidence
lib/index.jslib/utils/security.jslib/core/connection.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- lib/utils/security.js is heavily obfuscated, with encoded string data.
- lib/core/connection.js runs a string-decoding loop and constructs code through Function.
- The package entrypoint imports both obfuscated modules at load time.
- The manifest has no install lifecycle hooks; its dependencies include a latest-tag dependency and a package named path.
Evidence against
- The manifest identifies the package as a WhatsApp bot connector and points to lib/index.js as its entrypoint.
- The entrypoint creates a .cache directory in the current working directory; no concrete malicious effect is established by the inspected excerpts.
Behavioral surface
EvalFilesystem
Minified
WildcardDependency
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•Runtime dependency names matching Node built-ins: path
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg27"dependencies": {
"@cacheable/node-cache": "~1.4.0",
"@neoxr/api": "^1.5.3",
"@neoxr/helper": "latest",
"@zapo-js/media-utils": "^1.0.0",
"bytes": "^3.1.2",
"chalk": "4.1.0",
Medium
Suspicious Lifecycle Evidence
The manifest has no install lifecycle hooks; its dependencies include a latest-tag dependency and a package named path.
package.jsonView on unpkg · L27lib/index.jsView file
40require("dotenv/config");
const node_fs_1 = __importDefault(require("node:fs"));
const path_1 = __importDefault(require("path"));
const CACHE_DIR = path_1.default.join(process.cwd(), '.cache');
if (!node_fs_1.default.existsSync(CACHE_DIR)) {
node_fs_1.defa
Medium
Ai Review Evidence
Findings
1 High5 Medium2 Low
HighNode Builtin Dependency Squatpackage.json
MediumWildcard Dependency
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/utils/security.js
MediumAi Review Evidencelib/core/connection.js
LowEval
LowFilesystem
Affected versions and remediation
This report applies to @neoxr/zapo@1.0.4.
See all versions of @neoxr/zapo for other recorded verdicts.
- Review the evidence and your use of @neoxr/zapo@1.0.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.