@neoxr/zapo@1.1.7

⚠ Under review

TypeScript connector for building WhatsApp Bot (ZapoJS)

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 95.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

EvalFilesystem

Supply chain

MinifiedUrlStrings

Manifest

WildcardDependency

scanned 38 file(s), 1.47 MB of source, external domains: api.github.com, api.neoxr.eu, cdn.neoxr.eu, chat.whatsapp.com, facebook.com, google.com, instagram.com, itunes.apple.com, neoxr.eu, neoxr.my.id, play.google.com, threads.com, www.whatsapp.com

Source & flagged code

4 flagged

lib/types/index.jsView file

Lines 19-40javascript

19 *

20 * Here's a wild idea:

21 * CLOSE THE INSPECTOR AND BUILD SOMETHING YOURSELF.

22 *

23 * PROPRIETARY & CONFIDENTIAL INTELLECTUAL PROPERTY

25 *

26 * LEGAL NOTICE:

27 * This software contains proprietary implementations, original logic,

28 * and confidential technical information protected by applicable

29 * copyright and intellectual property laws.

30 *

31 * Unauthorized copying, extraction, redistribution, or derivative use

32 * may violate applicable laws and licensing terms.

33 *

34 * Removing this notice does not transfer ownership.

35 * Renaming the package does not make it yours.

36 * Obfuscating the evidence does not make the theft disappear.

37 *

38 * Be a developer. Not a glorified copy-paste machine.

39 */

40Function("aX2akX","\"use strict\";var ldxC7Xf,iua9WSF;function o3kiJYm(ldxC7Xf,iua9WSF,o3kiJYm){for(o3kiJYm=0x0;o3kiJYm<iua9WSF;o3kiJYm++)ldxC7Xf.push(ldxC7Xf.shift());return ldxC7Xf}const mkvgBd=o3kiJYm([\"D51FJeF\",\"__esModule\",\"version\",\"SQsKKZ\",\"length\",0x0,0x1,\"flViTVd\",\"

Long lines were clipped for display.

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/core/storage.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/core/storage.js#virtual:normalized:round1View on unpkg

lib/utils/stream.jsView file

•matchType = token_shingles matchedPackage = api-nebula@1.0.0 matchedPath = preinstall.cjs matchedIdentity = npm:YXBpLW5lYnVsYQ:1.0.0 similarity = 0.857 shingleOverlap = 18 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/utils/stream.jsView on unpkg

Source & flagged code

4 flagged · loading source

lib/types/index.jsView file

39*/ L40: Function("aX2akX","\"use strict\";var ldxC7Xf,iua9WSF;function o3kiJYm(ldxC7Xf,iua9WSF,o3kiJYm){for(o3kiJYm=0x0;o3kiJYm<iua9WSF;o3kiJYm++)ldxC7Xf.push(ldxC7Xf.shift());return ldxC7...

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/types/index.jsView on unpkg · L39

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/core/storage.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

Findings

3 High1 Medium3 Low

HighNode Builtin Dependency Squatpackage.json

HighSemantic Analysis Limitedlib/core/storage.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/utils/stream.js

MediumWildcard Dependency

LowEvallib/types/index.js

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to @neoxr/zapo@1.1.7.

See all versions of @neoxr/zapo for other recorded verdicts.

Review the evidence and your use of @neoxr/zapo@1.1.7 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-16 04:42:50.588Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.