registry / @open-wa/core / 5.0.0-alpha.8

@open-wa/core@5.0.0-alpha.8

Core orchestration backbone for open-wa WhatsApp automation

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

No confirmed malicious package-install or host attack surface. The main risk is intentional remote JS patch/license execution inside the controlled WhatsApp Web page during client startup or license unlock.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Calling createClient(...).start/injectWapi with patch/license configuration, or invoking window.WAPI.addLicenseKey in the page

Impact

Can modify the automated WhatsApp Web page runtime and send configured license/session metadata to OpenWA services; no host compromise path confirmed.

Mechanism

runtime browser-page script injection and optional remote patch/license payload eval

AI rationale

Remote eval and legacy obfuscation are high-risk dual-use design choices, but the inspected source shows package-aligned WhatsApp automation/license/patch behavior rather than unconsented install/import malware. No exfiltration of host secrets, destructive actions, persistence, or foreign AI-agent control-surface mutation was found.

Evidence

package.jsonsrc/createClient.tssrc/transport/Transport.tssrc/transport/httpClient.tssrc/transport/ScriptLoader.tssrc/transport/assets/wapi.jssrc/transport/assets/launch.jsdist/index.cjspatches.cache.json

Network endpoints5

web.whatsapp.com/patches.json

@open-wa/core@5.0.0-alpha.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code