@neoxr/zapo@1.0.5

TypeScript connector for building WhatsApp Bot (ZapoJS)

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The entrypoint loads extensively obfuscated modules that construct code dynamically, and a source comment attempts to discourage inspection. These facts warrant a warning, but the inspected source does not establish a concrete attack chain.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing lib/index.js.

Impact

The hidden runtime behavior cannot be resolved from the inspected source excerpts; no specific harm was confirmed.

Mechanism

The entrypoint creates a .cache directory and loads modules whose code is assembled through Function from encoded strings.

AI rationale

Evidence

lib/index.jslib/utils/security.jslib/utils/chiper.jslib/proxy/index.jslib/core/instance.jslib/utils/spam.jslib/utils/cooldown.jslib/utils/resolver.js.cache

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest describes a WhatsApp bot connector and names lib/index.js as its entrypoint.
Importing lib/index.js creates a .cache directory and loads utility, proxy, and runtime modules.
Several loaded modules construct code with Function from encoded string fragments, leaving their behavior opaque to static inspection.
A source comment directly tells inspectors to close the inspector.

Evidence against

Behavioral surface

Source

EvalFilesystem

Supply chain

Minified

Manifest

WildcardDependency

scanned 37 file(s), 6.87 MB of source

Source & flagged code

9 flagged

package.jsonView file

Lines 1-21json

2 "name": "@neoxr/zapo",

3 "version": "1.0.5",

4 "description": "TypeScript connector for building WhatsApp Bot (ZapoJS)",

5 "main": "lib/index.js",

6 "files": [

7 "lib/*"

8 ],

9 "repository": {

10 "type": "git",

Medium

Ai Review Evidence

The manifest describes a WhatsApp bot connector and names lib/index.js as its entrypoint.

package.jsonView on unpkg · L1

11 "url": "git+https://github.com/neoxr/zapo.git"

12 },

13 "keywords": [

14 "whattapp-bot",

15 "whatsapp-api",

16 "bot",

17 "whatsapp",

18 "wabot",

19 "baileys"

20 ],

21 "author": "Wildan Izzudin",

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/index.jsView file

Lines 20-65javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype

lib/utils/security.jsView file

Lines 20-40javascript

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

lib/utils/chiper.jsView file

Lines 20-40javascript

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

lib/proxy/index.jsView file

Lines 20-40javascript

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

lib/core/instance.jsView file

Lines 20-40javascript

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

lib/utils/spam.jsView file

40Function(Y(0x29a),Y(0x148c)+Y(0x830)+Y(0x1f9)+Y(0x3ce)+Y(0xc22)+Y(0x1387)+Y(0x8fc)+Y(0x506)+Y(0x9b6)+Y(0xef9)+Y(0xad2)+Y(0xc74)+Y(0x6ca)+Y(0x781)+Y(0xc21)+Y(0xf21)+Y(0xd37)+Y(0xed5

Medium

Ai Review Evidence

Several loaded modules construct code with Function from encoded string fragments, leaving their behavior opaque to static inspection.

lib/utils/spam.jsView on unpkg · L40

Source & flagged code

9 flagged · loading source

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

1{ "name": "@neoxr/zapo", "version": "1.0.5", "description": "TypeScript connector for building WhatsApp Bot (ZapoJS)", "main": "lib/index.js", "files": [ "lib/*" ], "repository": {

Medium

Ai Review Evidence

The manifest describes a WhatsApp bot connector and names lib/index.js as its entrypoint.

package.jsonView on unpkg · L1

lib/index.jsView file

40require("dotenv/config"); const node_fs_1 = __importDefault(require("node:fs")); const path_1 = __importDefault(require("path")); const CACHE_DIR = path_1.default.join(process.cwd(), '.cache'); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: tr

Medium

Ai Review Evidence

Findings

1 High9 Medium2 Low

HighNode Builtin Dependency Squatpackage.json

MediumWildcard Dependency

MediumAi Review Evidencepackage.json

MediumAi Review Evidencelib/index.js

MediumAi Review Evidencelib/utils/security.js

MediumAi Review Evidencelib/utils/chiper.js

MediumAi Review Evidencelib/proxy/index.js

MediumAi Review Evidencelib/core/instance.js

MediumAi Review Evidencelib/utils/spam.js

LowEval

LowFilesystem

Affected versions and remediation

This report applies to @neoxr/zapo@1.0.5.

See all versions of @neoxr/zapo for other recorded verdicts.

Review the evidence and your use of @neoxr/zapo@1.0.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-14 07:58:32.752Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.