registry / @prototypevip/baileys / 0.1.1

@prototypevip/baileys@0.1.1

Baileys fork (@prototypevip/baileys) — clean, without anti-ban, group encryption disabled (like 0.0.8)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At runtime, preparing any image or video appends a package-selected newsletter annotation to the outgoing media. This silently alters user-requested messages with concealed attribution metadata.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls prepareWAMessageMedia for an image or video.

Impact

Recipients and the WhatsApp service receive package-controlled newsletter attribution alongside user media.

Mechanism

automatic hidden newsletter-metadata injection into outbound media

Attack narrative

A consumer sending an image or video through the library invokes media preparation. The package unconditionally assigns a shared annotation object that embeds a newsletter identity, whose default is hex-obfuscated and not supplied by the consumer. The altered message is then sent through the library's normal WhatsApp transport, creating undisclosed attribution/promotion behavior.

Rationale

The lifecycle hook is benign, but runtime source establishes concealed, automatic modification of outbound user media with package-controlled newsletter metadata. This is concrete deceptive behavior rather than a package-aligned media implementation detail.

Evidence

package.jsonengine-requirements.jslib/Utils/messages.jslib/Utils/messages-media.jslib/Utils/generics.jslib/Utils/use-prototype-auth-state.js

@prototypevip/baileys@0.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code