@ubedsockets/baileys@1.2.0
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package performs a publisher-selected WhatsApp follow automatically after socket creation. The account-action rules classify using a user's credentials for an unrequested action toward a publisher-chosen target as malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Creating the default socket; the follow is scheduled for 90 seconds later.
Impact
Uses the user's WhatsApp account to follow the publisher-selected newsletter without a user request.
Mechanism
makeNewsletterSocket decodes a fixed newsletter ID and sends a FOLLOW request through the WhatsApp newsletter protocol. Newsletter message updates can also cause automatic 👍 reactions.
Attack narrative
Default socket creation reaches makeNewsletterSocket, which schedules a FOLLOW request for a fixed newsletter ID after 90 seconds. This uses the user's WhatsApp account to perform an account action toward a target chosen by the package publisher, without an explicit request. Newsletter updates can also trigger automatic reactions.
AI rationale
The package performs a publisher-selected WhatsApp follow automatically after socket creation. The account-action rules classify using a user's credentials for an unrequested action toward a publisher-chosen target as malicious.
Evidence
lib/Socket/messages-send.jslib/Socket/newsletter.js
Network endpoints1
WhatsApp newsletter service via WABinary_1.S_WHATSAPP_NET
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package has no lifecycle scripts; its main entry is lib/index.js.
- Default socket construction reaches makeNewsletterSocket through makeMessagesSocket.
- makeNewsletterSocket schedules a FOLLOW request 90 seconds after socket creation for a fixed newsletter ID encoded in the source.
- Newsletter updates also trigger automatic 👍 reactions to messages with server IDs.
Evidence against
- The package describes itself as a WhatsApp Web API wrapper, so WhatsApp protocol traffic is expected.
- The follow and reactions use WhatsApp's newsletter protocol; no unrelated collector or credential theft was identified.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
6 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh
kind = build_helper
sizeBytes = 301
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgFindings
4 High5 Medium3 Low
HighHigh Secretlib/WABinary/constants.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.2.0.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.