registry / @nexustechpro/baileys / 2.2.9

@nexustechpro/baileys@2.2.9

⚠ Under review

Advanced WhatsApp Web API built on Baileys — interactive messages, buttons, carousels, products, events, payments, polls, albums, sticker packs and more.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 121 file(s), 1.71 MB of source, external domains: a2ui.org, call.whatsapp.com, graph.whatsapp.com, latex.codecogs.com, mmg.whatsapp.net, v.whatsapp.net, wa.me, web.whatsapp.com, www.instagram.com, www.whatsapp.com

Source & flagged code

6 flagged

package.jsonView file

Lines 66-106json

66 "url": "git+https://github.com/nexustechpro2/baileys.git"

67 },

68 "license": "MIT",

69 "author": "nexustechpro2",

70 "main": "lib/index.js",

71 "types": "lib/index.d.ts",

72 "scripts": {

73 "build:all": "tsc && typedoc",

74 "build:docs": "typedoc",

75 "build:tsc": "tsc",

76 "generate:license": "npx license",

77 "changelog:last": "conventional-changelog -p angular -r 2",

78 "changelog:preview": "conventional-changelog -p angular -u",

79 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

80 "example": "node --inspect -r ts-node/register Example/example.ts",

81 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

82 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

83 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

84 "prepack": "echo 'NexusTechPro WhatsApp Library'",

85 "prepare": "echo 'NexusTechPro WhatsApp Library'",

86 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L86

87 "release": "release-it",

88 "test": "jest"

89 },

90 "files": [

91 "lib/**/*.js",

92 "lib/**/*.json",

93 "lib/**/*.d.ts",

94 "lib/**/*.map",

95 "WAProto/**/*.js",

96 "WAProto/**/*.json",

97 "WAProto/**/*.d.ts",

98 "WAProto/**/*.sh",

99 "engine-requirements.js"

100 ],

101 "dependencies": {

102 "@adiwajshing/keyed-db": "^0.2.4",

103 "@cacheable/node-cache": "^1.4.0",

104 "@hapi/boom": "^9.1.3",

105 "@keyv/etcd": "^2.1.1",

106 "@keyv/memcache": "^2.0.2",

lib/WABinary/constants.jsView file

Lines 600-640javascript

600 '044',

601 'mms_cat_v1_forward_hot_override_enabled',

602 'user_notice',

603 'ptt_waveform_send',

604 '047',

605 'Asia/Calcutta',

606

lib/Utils/use-multi-file-auth-state.jsView file

Lines 168-208javascript

168const COLLECTION_OPTION_KEY = {

169 '@keyv/mongo': 'collection',

170 '@keyv/postgres': 'table',

171 '@keyv/mysql': 'table',

172

lib/Utils/validate-connection.jsView file

98pull: false, L99: devicePairingData: { L100: buildHash: appVersionBuf, ... L129: ? WA_ADV_HOSTED_ACCOUNT_SIG_PREFIX L130: : Buffer.from([]) L131: ... L146: account.deviceSignature = Curve.sign( L147: signedIdentityKey.private, L148: Buffer.concat([WA_ADV_DEVICE_SIG_PREFIX, deviceDetails, signedIdentityKey.public, accountSignatureKey])

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L98

WAProto/parser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/parser.js#virtual:normalized:round1View on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

@nexustechpro/baileys@2.2.9

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code