@neoxr/zapo@1.0.6

TypeScript connector for building WhatsApp Bot (ZapoJS)

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The entrypoint eagerly imports modules that construct obfuscated runtime code, leaving behavior unresolved after static inspection. No concrete attack behavior was established, so the package warrants a warning rather than a block.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package loads the referenced modules.

Impact

The generated behavior remains opaque; no concrete data theft, external recipient, or system damage was established.

Mechanism

A runtime function is constructed from decoded string fragments; an obfuscated wrapper also supplies exports and require to generated code.

AI rationale

Evidence

lib/index.jslib/core/instance.jslib/utils/security.js.cache

Decision evidence

public snapshot

AI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The manifest names lib/index.js as the package entrypoint.
Importing the entrypoint loads lib/core/instance.js.
That module constructs a function from concatenated decoder outputs.
An obfuscated module passes exports and require into generated code.
The readable entrypoint creates a project-local .cache directory.

Evidence against

The readable entrypoint’s visible file-system effect is limited to creating .cache; inspection did not establish a concrete harmful action or external recipient.

Behavioral surface

Source

EvalFilesystem

Supply chain

Minified

Manifest

WildcardDependency

scanned 38 file(s), 7.34 MB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-25json

2 "name": "@neoxr/zapo",

3 "version": "1.0.6",

4 "description": "TypeScript connector for building WhatsApp Bot (ZapoJS)",

5 "main": "lib/index.js",

6 "files": [

Medium

Ai Review Evidence

The manifest names lib/index.js as the package entrypoint.

package.jsonView on unpkg · L5

7 "lib/*"

8 ],

9 "repository": {

10 "type": "git",

11 "url": "git+https://github.com/neoxr/zapo.git"

12 },

13 "keywords": [

14 "whattapp-bot",

15 "whatsapp-api",

16 "bot",

17 "whatsapp",

18 "wabot",

19 "baileys"

20 ],

21 "author": "Wildan Izzudin",

22 "license": "ISC",

23 "bugs": {

24 "url": "https://github.com/neoxr/zapo/issues"

25 },

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/index.jsView file

Lines 23-74javascript

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule)

lib/core/instance.jsView file

Lines 20-40javascript

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

lib/utils/security.jsView file

Lines 20-40javascript

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

Source & flagged code

6 flagged · loading source

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

5"main": "lib/index.js", "files": [

Medium

Ai Review Evidence

The manifest names lib/index.js as the package entrypoint.

package.jsonView on unpkg · L5

lib/index.jsView file

54exports.Proxy = Proxy; const instance_js_1 = __importDefault(require("./core/instance.js")); exports.Instance = instance

Medium

Ai Review Evidence

Importing the entrypoint loads lib/core/instance.js.

lib/index.jsView on unpkg · L54

Findings

1 High6 Medium2 Low

HighNode Builtin Dependency Squatpackage.json

MediumWildcard Dependency

MediumAi Review Evidencepackage.json

MediumAi Review Evidencelib/index.js

MediumAi Review Evidencelib/core/instance.js

MediumAi Review Evidencelib/utils/security.js

MediumAi Review Evidencelib/index.js

LowEval

LowFilesystem

Affected versions and remediation

This report applies to @neoxr/zapo@1.0.6.

See all versions of @neoxr/zapo for other recorded verdicts.

Review the evidence and your use of @neoxr/zapo@1.0.6 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 02:09:36.538Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.