registry / @ruthless-imperium/baileys / 1.0.0
@ruthless-imperium/baileys@1.0.0
WhatsApp Web API Library
AI Security Review
scanned 6h ago · by lpm-firewall-aiThe package has an unnecessary import-time child process that produces terminal output, so it merits a warning. The reviewed lifecycle hook only checks the Node version, and the external network calls inspected support version lookup, WhatsApp connectivity, or explicit media upload functionality; no malicious behavior was established.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Importing lib/index.js.
Impact
Unnecessary process creation and terminal output during import; the inspected spinner code shows no network or file activity.
Mechanism
The entry point runs embedded spinner code with the current Node executable, then kills the child after loading the library.
AI rationale
The package has an unnecessary import-time child process that produces terminal output, so it merits a warning. The reviewed lifecycle hook only checks the Node version, and the external network calls inspected support version lookup, WhatsApp connectivity, or explicit media upload functionality; no malicious behavior was established.
Evidence
lib/index.js
Network endpoints7
web.whatsapp.com/ws/chatcatbox.moe/user/api.phpscdn.pdi.moe/uploadqu.ax/upload.phpuguu.se/upload.phptmpfiles.org/api/v1/uploadregistry.npmjs.org/noxleyss
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Importing the main entry starts a Node child process for a terminal spinner before loading the library, then kills it after loading.
- The package preinstall hook checks the Node version and exits on versions below 20; it does not contact the network.
Evidence against
- The child process runs a short embedded spinner that writes to stdout; no file or network operations are shown in that code.
- Media uploads are implemented as a feature that posts the supplied buffer to public file-hosting services.
- The WhatsApp socket defaults point to WhatsApp’s web service.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Findings
6 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvallib/Utils/messages-media.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @ruthless-imperium/baileys@1.0.0.
See all versions of @ruthless-imperium/baileys for other recorded verdicts.
- Review the evidence and your use of @ruthless-imperium/baileys@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.