registry / @nexustechpro/baileys / 2.1.4

@nexustechpro/baileys@2.1.4

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 94 file(s), 1.82 MB of source, external domains: call.whatsapp.com, google.com, graph.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, v.whatsapp.net, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js4.23 MB file, sampled 256 KB

ChildProcess

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

620patternName = google_api_key severity = high line = 620 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L620

620patternName = google_api_key severity = high line = 620 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L620

lib/Utils/use-multi-file-auth-state.jsView file

290let mod L291: try { mod = await import(pkg) } catch (e) { L292: if (e.code === 'ERR_MODULE_NOT_FOUND') throw new Error(`[Auth] "${pkg}" is required for this backend — install it: npm i ${pkg}`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/use-multi-file-auth-state.jsView on unpkg · L290

lib/Utils/validate-connection.jsView file

111pull: false, L112: devicePairingData: { L113: buildHash: appVersionBuf, ... L138: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L139: let hmacPrefix = Buffer.from([]); L140: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L162: ]); L163: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L164: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L111

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

@nexustechpro/baileys@2.1.4

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code