registry / @nexustechpro/baileys / 2.2.2

@nexustechpro/baileys@2.2.2

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 102 file(s), 1.99 MB of source, external domains: call.whatsapp.com, google.com, graph.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, v.whatsapp.net, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js4.23 MB file, sampled 256 KB

ChildProcess

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

620patternName = google_api_key severity = high line = 620 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L620

620patternName = google_api_key severity = high line = 620 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L620

lib/Utils/use-multi-file-auth-state.jsView file

232let mod L233: try { mod = await import(pkg) } catch (e) { L234: if (e.code === 'ERR_MODULE_NOT_FOUND') throw new Error(`[Auth] "${pkg}" is required for this backend — install it: npm i ${pkg}`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/use-multi-file-auth-state.jsView on unpkg · L232

lib/Utils/validate-connection.jsView file

111pull: false, L112: devicePairingData: { L113: buildHash: appVersionBuf, ... L138: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L139: let hmacPrefix = Buffer.from([]); L140: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L162: ]); L163: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L164: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L111

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nexustechpro/baileys@2.1.4 matchedIdentity = npm:QG5leHVzdGVjaHByby9iYWlsZXlz:2.1.4 similarity = 0.774 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

620patternName = google_api_key severity = high line = 620 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L620

620patternName = google_api_key severity = high line = 620 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L620

lib/Utils/use-multi-file-auth-state.jsView file

232let mod L233: try { mod = await import(pkg) } catch (e) { L234: if (e.code === 'ERR_MODULE_NOT_FOUND') throw new Error(`[Auth] "${pkg}" is required for this backend — install it: npm i ${pkg}`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/use-multi-file-auth-state.jsView on unpkg · L232

lib/Utils/validate-connection.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L111

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Findings

4 High7 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighPrevious Version Dangerous Deltalib/Utils/messages.js

HighSecret Patternlib/WABinary/constants.js

MediumDynamic Requirelib/Utils/use-multi-file-auth-state.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build HelperWAProto/GenerateStatics.sh

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @nexustechpro/baileys@2.2.2.

See version security history for other recorded verdicts.

Review the evidence and your use of @nexustechpro/baileys@2.2.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-29 11:01:46.348Z (UTC).