Loading npm security reports…

@rixxcodex/baileys@8.0.16: Malicious npm security report (Block) | LPM Firewall

registry / @rixxcodex/baileys / 8.0.16

@rixxcodex/baileys@8.0.16

Websocket Whatsapp API for Node.js

AI Security Review

scanned 13d ago · by lpm-firewall-ai

On WhatsApp connection the library fetches a remote newsletter list from an obfuscated GitHub raw URL and uses the logged-in session to follow those channels. A second obfuscated helper can trigger the same follow query id.

Static reason

One or more suspicious static signals were detected.

Trigger

validateConnection runs socketConnect automatically while establishing the WhatsApp socket. generateMessageV runs only if a caller invokes the exported helper.

Impact

The connected WhatsApp account silently follows channels chosen by the remote JSON operator, without a user follow action.

Mechanism

Character-code and base64-XOR strings hide https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json and a follow target. The fetched ids are sent as newsletter_id in mex queries with query id 7871414976211147.

Attack narrative

When a user connects, validateConnection calls socketConnect before the handshake completes. That function rebuilds a GitHub raw URL from character codes, downloads JSON, and after 200 seconds issues WhatsApp follow queries for every returned newsletter id. Failures are swallowed. generateMessageV additionally decodes an XOR string and calls a supplied function with the FOLLOW query id, so the same hidden follow can be triggered from the exported socket API.

AI rationale

The package silently uses the authenticated WhatsApp session to follow newsletters supplied by an obfuscated third-party URL, which is concrete malicious session abuse. There is no install hook, but the behavior runs on normal connection.

Evidence

lib/Socket/socket.jslib/Types/Newsletter.js

Network endpoints1

/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json

Source & flagged code

6 flagged · loading source

lib/WABinary/constants.jsView file

601patternName = google_api_key severity = high line = 601

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L601

601patternName = google_api_key severity = high line = 601

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L601

lib/Utils/crypto.jsView file

1//=======================================================// L2: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto"; L3: import { KEY_BUNDLE_TYPE } from "../Defaults/index.js"; ... L11: return { L12: private: Buffer.from(privKey), L13: public: Buffer.from(pubKey.slice(1))

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

lib/Utils/messages-media.jsView file

8import { Readable, Transform } from "stream"; L9: import { exec } from "child_process"; L10: import { Boom } from "@hapi/boom"; ... L35: hasher.update(data); L36: if (!fileWriteStream.write(data)) { L37: await once(fileWriteStream, "drain"); ... L67: if (typeof buffer === "string") { L68: buffer = Buffer.from(buffer.replace("data:;base64,", ""), "base64"); L69: } ... L206: } L207: if (urlStr.startsWith("http://") || urlStr.startsWith("https://")) { L208: return { stream: await getHttpStream(item.url, opts), type: "remote" };

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/Utils/messages-media.jsView on unpkg · L8

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4263226 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

Source & flagged code

6 flagged

lib/WABinary/constants.jsView file

Lines 581-621javascript

581 "044",

582 "mms_cat_v1_forward_hot_override_enabled",

583 "user_notice",

584 "ptt_waveform_send",

585 "047",

586 "Asia/Calcutta",

587 "250",

588 "md_privacy_v2",

589 "31",

590 "29",

591 "128",

592 "md_messaging_enabled",

593 "046",

594 "crypto",

595 "690",

596 "045",

597 "enc_iv",

598 "75",

599 "failure",

600 "ptt_oot_playback",

601 "AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L601

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L601

602 "w",

603 "048",

604 "2201",

605 "web_large_files_ui",

606 "Asia/Makassar",

607 "812",

608 "status_collapse_muted",

609 "1334",

610 "257",

611 "2HP4dm",

612 "049",

613 "patches",

614 "1290",

615 "43cY6T",

616 "America/Caracas",

617 "web_sticker_maker",

618 "campaign",

619 "ptt_pausable_enabled",

620 "33",

621 "42",

lib/Utils/crypto.jsView file

Lines 1-21javascript

1//=======================================================//

2import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";

3import { KEY_BUNDLE_TYPE } from "../Defaults/index.js";

4import * as curve from "@rixxcodex/libsignal/src/curve.js";

lib/Utils/messages-media.jsView file

Lines 1-28javascript

1//=======================================================//

2import { getBinaryNodeChild, getBinaryNodeChildBuffer, jidNormalizedUser } from "../WABinary/index.js";

3import { DEFAULT_ORIGIN, MEDIA_HKDF_KEY_MAPPING, MEDIA_PATH_MAP } from "../Defaults/index.js";

4import { createReadStream, createWriteStream, promises as fs, WriteStream } from "fs";

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4263226 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg