Loading npm security reports…

@nexustechpro/baileys@2.2.7: Malicious npm security report | LPM Firewall

registry / @nexustechpro/baileys / 2.2.7

@nexustechpro/baileys@2.2.7

Advanced WhatsApp Web API built on Baileys — interactive messages, buttons, carousels, products, events, payments, polls, albums, sticker packs and more.

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16104 confirms this npm version as malicious. @nexustechpro/baileys is a fork of the WhatsApp library `baileys` in which lib/Socket/chats.js (~270 KB) is heavily obfuscated (obfuscator.io-style rotating string-array decoder, hex-escaped import specifiers such as '\x40\x63\x61\x63\x68\x65\x61\x62\x6c\x65\x2f\x6e\x6f\x64\x65\x2d\x63\x61\x63\x68\x65', integer-arithmetic control flow, unicode identifier names, ~2772-entry string array) while every sibling file in...

Advisory

MAL-2026-16104

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @nexustechpro/baileys (npm)

Details

@nexustechpro/baileys is a fork of the WhatsApp library `baileys` in which lib/Socket/chats.js (~270 KB) is heavily obfuscated (obfuscator.io-style rotating string-array decoder, hex-escaped import specifiers such as '\x40\x63\x61\x63\x68\x65\x61\x62\x6c\x65\x2f\x6e\x6f\x64\x65\x2d\x63\x61\x63\x68\x65', integer-arithmetic control flow, unicode identifier names, ~2772-entry string array) while every sibling file in lib/Socket/ (groups.js, messages-recv.js, socket.js, registration.js) remains readable JavaScript and the upstream whiskeysockets/baileys ships this file unobfuscated. The obfuscated module is reachable from the package entry point (lib/index.js) and sits directly in the code path that handles WhatsApp session state (authState credentials, Signal identity keys, noise keys, signed pre-keys). package.json additionally declares `"whatsapp-rust-bridge": "latest"`, a floating unpinned tag on a non-upstream dependency, which allows that dependency's publisher to ship arbitrary code (including install lifecycle scripts) into every installer of this package on any future install with no version pin or integrity check.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Source & flagged code

6 flagged

package.jsonView file

Lines 66-106json

66 "url": "git+https://github.com/nexustechpro2/baileys.git"

67 },

68 "license": "MIT",

69 "author": "nexustechpro2",

70 "main": "lib/index.js",

71 "types": "lib/index.d.ts",

72 "scripts": {

73 "build:all": "tsc && typedoc",

74 "build:docs": "typedoc",

75 "build:tsc": "tsc",

76 "generate:license": "npx license",

77 "changelog:last": "conventional-changelog -p angular -r 2",

78 "changelog:preview": "conventional-changelog -p angular -u",

79 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

80 "example": "node --inspect -r ts-node/register Example/example.ts",

81 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

82 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

83 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

84 "prepack": "echo 'NexusTechPro WhatsApp Library'",

85 "prepare": "echo 'NexusTechPro WhatsApp Library'",

86 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

87 "release": "release-it",

88 "test": "jest"

89 },

90 "files": [

91 "lib/**/*.js",

92 "lib/**/*.json",

93 "lib/**/*.d.ts",

94 "lib/**/*.map",

95 "WAProto/**/*.js",

96 "WAProto/**/*.json",

97 "WAProto/**/*.d.ts",

98 "WAProto/**/*.sh",

99 "engine-requirements.js"

100 ],

101 "dependencies": {

102 "@adiwajshing/keyed-db": "^0.2.4",

103 "@cacheable/node-cache": "^1.4.0",

104 "@hapi/boom": "^9.1.3",

105 "@keyv/etcd": "^2.1.1",

106 "@keyv/memcache": "^2.0.2",

lib/WABinary/constants.jsView file

Lines 600-640javascript

600 '044',

601 'mms_cat_v1_forward_hot_override_enabled',

602 'user_notice',

603 'ptt_waveform_send',

604 '047',

605 'Asia/Calcutta',

606

lib/Utils/messages-media.jsView file

Lines 1-40javascript

1import { Boom } from '@hapi/boom'

2import { spawn } from 'child_process'

3import * as Crypto from 'crypto'

4import { once } from 'events'

lib/Utils/validate-connection.jsView file

Lines 91-131javascript

91 supportBizHostedMsg: true,

92 supportRecentSyncChunkMessageCountTuning: true,

93 supportHostedGroupMsg: true,

94 supportFbidBotChatHistory: true,

95

WAProto/parser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/parser.js#virtual:normalized:round1View on unpkg