@neoxr/zapo@1.1.9
TypeScript connector for building WhatsApp Bot (ZapoJS)
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe opaque dynamically constructed payload leaves real unresolved risk, but the inspected guard and lack of confirmed attack behavior do not support blocking. Recommend a warning pending clarification of the obfuscated runtime code.
Static reason
The scanner resource watchdog stopped analysis before complete coverage. This unresolved result requires AI review and must not be published as clean, warn, or block.
Trigger
Importing the package loads its runtime modules; the visible calls inside the constructed code require a process ID check that does not appear reachable under normal conditions.
Impact
The guarded payload's purpose remains unresolved; the inspected source does not establish data theft or another active attack.
Mechanism
Obfuscated code constructs a function from an encoded string and places calls behind a fixed negative process ID comparison.
AI rationale
The opaque dynamically constructed payload leaves real unresolved risk, but the inspected guard and lack of confirmed attack behavior do not support blocking. Recommend a warning pending clarification of the obfuscated runtime code.
Evidence
lib/core/connection.jslib/utils/security.jslib/utils/chiper.jslib/core/instance.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exposes an obfuscated runtime file containing dynamically constructed code; its behavior could not be resolved by static inspection.
- The constructed code is followed by a process ID check against a fixed negative value, so the visible calls are guarded and no active attack is confirmed.
- The manifest identifies the package as a WhatsApp bot connector and points to lib/index.js as its entrypoint.
Evidence against
- The manifest contains no lifecycle scripts.
- The entrypoint creates a project-local .cache directory and imports package modules; these actions alone do not establish an attack.
Behavioral surface
Source & flagged code
8 flagged · loading sourcesource
•stage = scanner_worker; reason = analysis_timeout
High
Semantic Analysis Limited
The scanner resource watchdog stopped semantic analysis before full coverage; route this package to AI without publishing a static verdict.
package.jsonView file
4"description": "TypeScript connector for building WhatsApp Bot (ZapoJS)",
"main": "lib/index.js",
"files": [
"lib/*"
],
"repository": {
"type": "git",
"url":
Medium
Ai Review Evidence
The manifest identifies the package as a WhatsApp bot connector and points to lib/index.js as its entrypoint.
package.jsonView on unpkg · L4lib/index.jsView file
40require("dotenv/config");
const node_fs_1 = __importDefault(require("node:fs"));
const path_1 = __importDefault(require("path"));
const CACHE_DIR = path_1.default.join(process.cwd(), '.cache');
if (!node_fs_1.default.existsSync(CACHE_DIR)) {
node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true });
}
const security_js_1 = __importDefault(require("./utils/security.js"));
exports.Security = s
Findings
1 High7 Medium
HighSemantic Analysis Limited
MediumAi Review Evidencepackage.json
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/core/connection.js
MediumAi Review Evidencelib/core/connection.js
MediumAi Review Evidencelib/utils/security.js
MediumAi Review Evidencelib/utils/chiper.js
MediumAi Review Evidencelib/core/instance.js
Affected versions and remediation
This report applies to @neoxr/zapo@1.1.9.
See all versions of @neoxr/zapo for other recorded verdicts.
- Review the evidence and your use of @neoxr/zapo@1.1.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.