@randev404/baileys@1.0.2
Baileys modified by Ran
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 1d ago · by lpm-firewall-aiInspected source shows an automatic, default-enabled account action targeting publisher-selected newsletters after connection. This is concrete unauthorized account behavior, so the package is malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer creates the socket and its connection opens.
Impact
The connected account is subscribed to channels without a request to follow those specific channels.
Mechanism
The default-enabled helper calls the follow operation for each hardcoded newsletter identifier.
Attack narrative
The package entrypoint exports a socket factory that imports a custom follow helper. When the connection opens, the factory invokes that helper. Its default configuration enables automatic following and supplies two fixed newsletter identifiers; the helper follows each one through the connected account.
AI rationale
Inspected source shows an automatic, default-enabled account action targeting publisher-selected newsletters after connection. This is concrete unauthorized account behavior, so the package is malicious.
Evidence
package.jsonlib/index.jslib/Socket/index.jslib/custom.js
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json selects lib/index.js, which exports the socket factory through the package entrypoint.
- The socket factory imports the follow helper and invokes it when the connection opens.
- The helper defaults automatic following on and contains two publisher-selected newsletter identifiers.
- With that default enabled, the helper calls newsletterFollow for each configured identifier.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
WAProto/index.js
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Crypto
Affected versions and remediation
This report applies to @randev404/baileys@1.0.2.
See all versions of @randev404/baileys for other recorded verdicts.
- Avoid installing @randev404/baileys@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.