registry / @sanzoffc/baileys / 3.0.4

@sanzoffc/baileys@3.0.4

Websocket Whatsapp API for Node.js

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

When a WhatsApp socket is opened, concealed code retrieves attacker-controlled newsletter IDs and follows them through the authenticated WhatsApp session. A second automatic follow path is initialized by the newsletter socket.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Creating and connecting a WhatsApp socket.

Impact

The package causes unrequested actions on the user's WhatsApp account and lets a remote list choose the targets.

Mechanism

Obfuscated remote list retrieval followed by automatic newsletter subscriptions.

Attack narrative

The normal connection path calls socketConnect. It decodes and fetches a GitHub-hosted list, then issues WhatsApp newsletter follow queries for each returned identifier. Separately, newsletter initialization invokes loadBase, which decodes another remote URL and follows every supplied ID. Both operations are delayed and concealed, preventing the user from knowingly approving account actions.

AI rationale

This is concealed, remote-controlled use of an authenticated WhatsApp session to alter subscriptions without a caller request. No install hook is present, but the runtime behavior is concrete malicious account abuse.

Evidence

lib/Socket/socket.jslib/Utils/messages-media.jslib/Types/Newsletter.js

Network endpoints3

raw.githubusercontent.comraw.githubusercontentusercontent.com

This package is a fork of the Baileys WhatsApp library that adds covert remote-controlled behavior driven by the installer's authenticated WhatsApp session. In lib/Socket/socket.js, socketConnect() (invoked from validateConnection on every WebSocket open) reconstructs a URL from a String.fromCharCode char-code array that resolves to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, fetches that JSON list, and iterates it to issue WhatsApp GraphQL mutations with query_id 7871414976211147 (newsletter subscribe/follow) for each id in the remote-supplied list. The list is hosted on a mutable personal-GitHub branch controlled by a third party, so whoever edits that file determines which actions the installer's WhatsApp account performs. A second helper (generateMessageV) base64+XOR-decodes (key 23) a hardcoded '@newsletter' JID and pairs it with the same query_id 7871414976211147, then schedules the same subscription action 40 seconds after invocation - layered string obfuscation of a fixed destination JID that has no legitimate purpose in a WhatsApp protocol library. The behavior is not documented, not caller-configurable, and the URL and JID are deliberately obfuscated to evade string scanners. The manifest additionally declares '@whiskeysockets/eslint-config' as an unpinned github: source and pins most other dependencies to '*', widening the resolution trust boundary.

@sanzoffc/baileys@3.0.4

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code