@open-wa/core: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@open-wa/core: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/transport/assets/base64.jsView file

1!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?module.exports=o(e):"function"==typeof define&&define.amd?define(o):o(e)}("undefined"!=typeof self?self:"undefin...

High

Eval

Package source references dynamic code evaluation.

dist/transport/assets/base64.jsView on unpkg · L1

dist/transport/assets/launch.jsView file

4//evaluate the code L5: window.moduleRaid=function(){moduleRaid.mID=Math.random().toString(36).substring(7),moduleRaid.mObj={};const e=parseInt(window.Debug?.VERSION?.split(".")?.[1])>=3e3;return fillModu... L6: window.isRipeSession=function(){return document.getElementsByClassName(require("WAWebIntroPanel.scss").intro).length};;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transport/assets/launch.jsView on unpkg · L4

dist/transport/assets/wapi.jsView file

19{ id: "Wap", module: "WAWebCreateGroupAction", conditions: (module) => (module.createGroup) ? module : null }, L20: { id: "State", module: "WAWebSocketModel", conditions: (module) => (module.STATE && module.STREAM) ? module : null }, L21: { id: "_Presence", module: "WAWebContactPresenceBridge", conditions: (module) => (module.setPresenceAvailable && module.setPresenceUnavailable) ? module : null }, ... L105: contact: obj['contact'] ? window.WAPI._serializeContactObj(obj['contact']) : null, L106: groupMetadata: obj["groupMetadata"] ? window.WAPI._serializeRawObj(obj["groupMetadata"]) : null, L107: presence: obj["presence"] ? window.WAPI._serializeRawObj(obj["presence"]) : null, ... L606: * @returns {Promise.<*>} Yields group metadata L607: * @private L608: */ ... L955: const ab = (awai

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/transport/assets/wapi.jsView on unpkg · L19

dist/transport/assets/init_patch.jsView file

1function _0x264f1c(_0x51a492,_0x4368a7){return _0x46f3(_0x51a492-0x2ab,_0x4368a7);}(function(_0x4e0037,_0x16b75e){function _0x4bbdfe(_0x194876,_0x43510b){return _0x46f3(_0x43510b-0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/transport/assets/init_patch.jsView on unpkg · L1

dist/transport/assets/base64.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/transport/assets/base64.js#virtual:normalized:round1View on unpkg

dist/index.cjsView file

•matchType = token_shingles matchedPackage = @open-wa/core@5.1.0 matchedPath = dist/index.cjs matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.1.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/transport/assets/hash.jsView file

•matchType = normalized_sha256 matchedPackage = @open-wa/core@5.1.0 matchedPath = dist/transport/assets/hash.js matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transport/assets/hash.jsView on unpkg

Source & flagged code

7 flagged

dist/transport/assets/base64.jsView file

Lines 1-1javascript

1!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?module.exports=o(e):"function"==typeof define&&define.amd?define(o):o(e)}("undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:this,function(global){"use strict";global=global||{};var _Base64=global.Base64,version="2.5.2",buffer;if("undefined"!=typeof module&&module.exports)try{buffer=eval("require('buffer').Buffer")}catch(e){buffer=void 0}var b64chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",b64tab=function(e){for(var o={},r=0,t=e.length;r<t;r++)o[e.charAt ...

High

Eval

Package source references dynamic code evaluation.

dist/transport/assets/base64.jsView on unpkg · L1

Long lines were clipped for display.

dist/transport/assets/launch.jsView file

Lines 1-10javascript

1

2 (async function() {

3 if(WAPI.sendMessage.toString().includes('Not a contact') && !WAPI.sendMessageToID) {

4 //evaluate the code

dist/transport/assets/wapi.jsView file

Lines 1-39javascript

1/**

2 * This script contains WAPI functions that need to be run in the context of the webpage

3 */

4

5/**

6 * Auto discovery the webpack object references of instances that contains all functions used by the WAPI

7 * functions and creates the Store object.

8 */

9

10if (!window.Store ||

dist/transport/assets/init_patch.jsView file

Lines 1-1javascript

1function _0x264f1c(_0x51a492,_0x4368a7){return _0x46f3(_0x51a492-0x2ab,_0x4368a7);}(function(_0x4e0037,_0x16b75e){function _0x4bbdfe(_0x194876,_0x43510b

dist/transport/assets/base64.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/transport/assets/base64.js#virtual:normalized:round1View on unpkg

dist/index.cjsView file

•matchType = token_shingles matchedPackage = @open-wa/core@5.1.0 matchedPath = dist/index.cjs matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.1.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/transport/assets/hash.jsView file

•matchType = normalized_sha256 matchedPackage = @open-wa/core@5.1.0 matchedPath = dist/transport/assets/hash.js matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transport/assets/hash.jsView on unpkg