Loading npm security reports…

@open-wa/core@5.1.0: Malicious npm security report (Block) | LPM Firewall

registry / @open-wa/core / 5.1.0

@open-wa/core@5.1.0

Core orchestration backbone for open-wa WhatsApp automation

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The runtime downloads remote JavaScript patches and evaluates them in an authenticated WhatsApp browser page. A bundled obfuscated patch also makes external requests and interacts with WhatsApp APIs.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Launching the package's WhatsApp transport after authentication.

Impact

A remote operator can execute arbitrary browser-context code in an authenticated WhatsApp session and the bundled patch may expose session-associated network and messaging activity.

Mechanism

The entrypoint fetches remote patch payloads and passes their script text to browser-page evaluation; the local injected patch contains obfuscated network and messaging-related behavior.

Attack narrative

At runtime, the package retrieves patch scripts from package-controlled or repository endpoints and evaluates them in the WhatsApp Web page without a visible signature or content-integrity validation. Its automatically injected local patch is intentionally obfuscated and includes external fetches, IP handling, and WhatsApp API calls. This provides a concrete remote browser-code execution channel in an authenticated messaging session.

AI rationale

The automatic remote-script download and evaluation path is a concrete remote code execution capability. The obfuscated bundled browser payload reinforces that this is not a transparent compatibility patch mechanism.

Evidence

dist/index.cjsdist/transport/assets/init_patch.js

Network endpoints2

cdn.openwa.dev/patches.json

Source & flagged code

9 flagged · loading source

dist/transport/assets/base64.jsView file

1!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?module.exports=o(e):"function"==typeof define&&define.amd?define(o):o(e)}("undefined"!=typeof self?self:"undefin...

High

Eval

Package source references dynamic code evaluation.

dist/transport/assets/base64.jsView on unpkg · L1

dist/transport/assets/launch.jsView file

4//evaluate the code L5: window.moduleRaid=function(){moduleRaid.mID=Math.random().toString(36).substring(7),moduleRaid.mObj={};const e=parseInt(window.Debug?.VERSION?.split(".")?.[1])>=3e3;return fillModu... L6: window.isRipeSession=function(){return document.getElementsByClassName(require("WAWebIntroPanel.scss").intro).length};;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transport/assets/launch.jsView on unpkg · L4

dist/transport/assets/wapi.jsView file

19{ id: "Wap", module: "WAWebCreateGroupAction", conditions: (module) => (module.createGroup) ? module : null }, L20: { id: "State", module: "WAWebSocketModel", conditions: (module) => (module.STATE && module.STREAM) ? module : null }, L21: { id: "_Presence", module: "WAWebContactPresenceBridge", conditions: (module) => (module.setPresenceAvailable && module.setPresenceUnavailable) ? module : null }, ... L105: contact: obj['contact'] ? window.WAPI._serializeContactObj(obj['contact']) : null, L106: groupMetadata: obj["groupMetadata"] ? window.WAPI._serializeRawObj(obj["groupMetadata"]) : null, L107: presence: obj["presence"] ? window.WAPI._serializeRawObj(obj["presence"]) : null, ... L606: * @returns {Promise.<*>} Yields group metadata L607: * @private L608: */ ... L955: const ab = (awai

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/transport/assets/wapi.jsView on unpkg · L19

dist/transport/assets/init_patch.jsView file

1function _0x264f1c(_0x51a492,_0x4368a7){return _0x46f3(_0x51a492-0x2ab,_0x4368a7);}(function(_0x4e0037,_0x16b75e){function _0x4bbdfe(_0x194876,_0x43510b){return _0x46f3(_0x43510b-0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/transport/assets/init_patch.jsView on unpkg · L1

dist/transport/assets/base64.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/transport/assets/base64.js#virtual:normalized:round1View on unpkg

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @open-wa/core@5.0.0-alpha.8 matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0-alpha.8 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

•matchType = token_shingles matchedPackage = @open-wa/core@5.0.0 matchedPath = dist/index.cjs matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/index.mjsView file

•matchType = token_shingles matchedPackage = @open-wa/core@5.0.0 matchedPath = dist/index.mjs matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

dist/transport/assets/hash.jsView file

•matchType = normalized_sha256 matchedPackage = @open-wa/core@5.0.0 matchedPath = dist/transport/assets/hash.js matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transport/assets/hash.jsView on unpkg

Source & flagged code

9 flagged

dist/transport/assets/base64.jsView file

Lines 1-1javascript

1!function(e,o){"object"==typeof exports&&"undefined"!=typeof module?module.exports=o(e):"function"==typeof define&&define.amd?define(o):o(e)}("undefined"!=typeof self?self:"undefined"!=typeof window?window:"undefined"!=typeof global?global:this,function(global){"use strict";global=global||{};var _Base64=global.Base64,version="2.5.2",buffer;if("undefined"!=typeof module&&module.exports)try{buffer=eval("require('buffer').Buffer")}catch(e){buffer=void 0}var b64chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",b64tab=function(e){for(var o={},r=0,t=e.length;r<t;r++)o[e.charAt ...

High

Eval

Package source references dynamic code evaluation.

dist/transport/assets/base64.jsView on unpkg · L1

Long lines were clipped for display.

dist/transport/assets/launch.jsView file

Lines 1-10javascript

1

2 (async function() {

3 if(WAPI.sendMessage.toString().includes('Not a contact') && !WAPI.sendMessageToID) {

4 //evaluate the code

dist/transport/assets/wapi.jsView file

Lines 1-39javascript

1/**

2 * This script contains WAPI functions that need to be run in the context of the webpage

3 */

4

5/**

6 * Auto discovery the webpack object references of instances that contains all functions used by the WAPI

7 * functions and creates the Store object.

8 */

9

10if (!window.Store ||

dist/transport/assets/init_patch.jsView file

Lines 1-1javascript

1function _0x264f1c(_0x51a492,_0x4368a7){return _0x46f3(_0x51a492-0x2ab,_0x4368a7);}(function(_0x4e0037,_0x16b75e){function _0x4bbdfe(_0x194876,_0x43510b

dist/transport/assets/base64.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/transport/assets/base64.js#virtual:normalized:round1View on unpkg

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @open-wa/core@5.0.0-alpha.8 matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0-alpha.8 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

•matchType = token_shingles matchedPackage = @open-wa/core@5.0.0 matchedPath = dist/index.cjs matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/index.mjsView file

•matchType = token_shingles matchedPackage = @open-wa/core@5.0.0 matchedPath = dist/index.mjs matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

dist/transport/assets/hash.jsView file

•matchType = normalized_sha256 matchedPackage = @open-wa/core@5.0.0 matchedPath = dist/transport/assets/hash.js matchedIdentity = npm:QG9wZW4td2EvY29yZQ:5.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/transport/assets/hash.jsView on unpkg