Loading npm security reports…

@rixxcodex/baileys@9.0.1: Malicious npm security report (Block) | LPM Firewall

registry / @rixxcodex/baileys / 9.0.1

@rixxcodex/baileys@9.0.1

Websocket Whatsapp API for Node.js

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Connecting a WhatsApp socket fetches a remote newsletter list from raw.githubusercontent.com and follows those channels with the logged-in account. A second obfuscated helper can issue the same follow query after a delay.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

validateConnection calls socketConnect during the normal WhatsApp handshake.

Impact

The connected WhatsApp account silently follows attacker-chosen newsletters without the application asking the user.

Mechanism

Character codes hide a GitHub raw JSON URL. The response is parsed and each id is sent in a w:mex iq using the newsletter FOLLOW query id. Errors are swallowed.

Attack narrative

When a client opens a WhatsApp session, the handshake runs socketConnect before login finishes. That function decodes a hard-coded character list into a GitHub raw URL, downloads JSON, and for each entry sends a WhatsApp mex follow query. Failures are ignored and the follow is delayed about 200 seconds. A second helper, generateMessageV, XOR-decodes a base64 string and, if a caller supplies the query function, repeats the same follow id after 40 seconds. The effect is hidden newsletter follows on the user's account, driven by a package-chosen remote list.

AI rationale

The connect path hides a remote fetch and uses the user's WhatsApp session to follow newsletters from that list. Obfuscation and swallowed errors show this is intentional account abuse, not a documented WhatsApp feature.

Evidence

lib/Socket/socket.jslib/Types/Newsletter.js

Network endpoints1

/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json

Source & flagged code

7 flagged · loading source

lib/WABinary/constants.jsView file

601patternName = google_api_key severity = high line = 601

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L601

601patternName = google_api_key severity = high line = 601

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L601

lib/Utils/crypto.jsView file

1//=======================================================// L2: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto"; L3: import { KEY_BUNDLE_TYPE } from "../Defaults/index.js"; ... L11: return { L12: private: Buffer.from(privKey), L13: public: Buffer.from(pubKey.slice(1))

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

lib/Utils/messages-media.jsView file

8import { Readable, Transform } from "stream"; L9: import { exec } from "child_process"; L10: import { Boom } from "@hapi/boom"; ... L35: hasher.update(data); L36: if (!fileWriteStream.write(data)) { L37: await once(fileWriteStream, "drain"); ... L67: if (typeof buffer === "string") { L68: buffer = Buffer.from(buffer.replace("data:;base64,", ""), "base64"); L69: } ... L206: } L207: if (urlStr.startsWith("http://") || urlStr.startsWith("https://")) { L208: return { stream: await getHttpStream(item.url, opts), type: "remote" };

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/Utils/messages-media.jsView on unpkg · L8

•matchType = normalized_sha256 matchedPackage = @rixxcodex/baileys@8.2.0 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QHJpeHhjb2RleC9iYWlsZXlz:8.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4263226 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

Source & flagged code

7 flagged

lib/WABinary/constants.jsView file

Lines 581-621javascript

581 "044",

582 "mms_cat_v1_forward_hot_override_enabled",

583 "user_notice",

584 "ptt_waveform_send",

585 "047",

586 "Asia/Calcutta",

587 "250",

588 "md_privacy_v2",

589 "31",

590 "29",

591 "128",

592 "md_messaging_enabled",

593 "046",

594 "crypto",

595 "690",

596 "045",

597 "enc_iv",

598 "75",

599 "failure",

600 "ptt_oot_playback",

601 "AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L601

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L601

602 "w",

603 "048",

604 "2201",

605 "web_large_files_ui",

606 "Asia/Makassar",

607 "812",

608 "status_collapse_muted",

609 "1334",

610 "257",

611 "2HP4dm",

612 "049",

613 "patches",

614 "1290",

615 "43cY6T",

616 "America/Caracas",

617 "web_sticker_maker",

618 "campaign",

619 "ptt_pausable_enabled",

620 "33",

621 "42",

lib/Utils/crypto.jsView file

Lines 1-21javascript

1//=======================================================//

2import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";

3import { KEY_BUNDLE_TYPE } from "../Defaults/index.js";

4import * as curve from "@rixxcodex/libsignal/src/curve.js";

lib/Utils/messages-media.jsView file

Lines 1-28javascript

1//=======================================================//

2import { getBinaryNodeChild, getBinaryNodeChildBuffer, jidNormalizedUser } from "../WABinary/index.js";

3import { DEFAULT_ORIGIN, MEDIA_HKDF_KEY_MAPPING, MEDIA_PATH_MAP } from "../Defaults/index.js";

4import { createReadStream, createWriteStream, promises as fs, WriteStream } from "fs";

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4263226 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg