registry / @sakataoffc/baileys / 9.0.0

@sakataoffc/baileys@9.0.0

⚠ Under review

A WebSockets library for interacting with WhatsApp Web.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 2.03 MB of source, external domains: acs.whatsapp.com, call.whatsapp.com, graph.whatsapp.com, kyuux-r.indevs.in, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js11.6 MB file, sampled 256 KB

No sampled risky behavior triggered.

Source & flagged code

8 flagged

package.jsonView file

Lines 14-54json

14 },

15 "license": "MIT",

16 "author": "t.me/sakata_real",

17 "main": "lib/index.js",

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "build:all": "tsc && typedoc",

25 "build:docs": "typedoc",

26 "build:tsc": "tsc",

27 "changelog:last": "conventional-changelog -p angular -r 2",

28 "changelog:preview": "conventional-changelog -p angular -u",

29 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

30 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

31 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

32 "prepack": "",

33 "prepare": "",

34 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

35 "release": "release-it",

36 "test": "jest"

37 },

38 "dependencies": {

39 "@cacheable/node-cache": "^1.4.0",

40 "@hapi/boom": "^9.1.3",

41 "async-mutex": "^0.5.0",

42 "cache-manager": "^7.2.8",

43 "chalk": "^4.1.2",

44 "fluent-ffmpeg": "^2.1.3",

45 "libsignal": "^6.0.0",

46 "lru-cache": "^11.1.0",

47 "music-metadata": "^11.12.3",

48 "p-queue": "^9.0.0",

49 "pino": "^9.6",

50 "protobufjs": "^7.5.6",

51 "sharp": "^0.35.5",

52 "whatsapp-rust-bridge": "0.5.4",

53 "ws": "^8.13.0"

54 },

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @lekzo/baileys@0.0.6 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGxla3pvL2JhaWxleXM:0.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

@sakataoffc/baileys@9.0.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code