@ubedsockets/baileys@1.5.0
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package automatically follows a hard-coded WhatsApp newsletter after socket construction, using the user's authenticated account without consent. This is an unrequested account action toward a publisher-selected target.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Construction of the message socket; the action runs after a 90-second timer.
Impact
Changes the user's account subscriptions without a request and may signal endorsement of the selected newsletter.
Mechanism
Decodes a hard-coded newsletter ID and sends a WhatsApp FOLLOW query.
Attack narrative
When the message socket is constructed, it creates the newsletter layer. That layer schedules a timer which, after 90 seconds, decodes a hard-coded newsletter ID and sends a FOLLOW query over the user's WhatsApp connection. The account action targets a newsletter selected by the publisher and is not requested by the user.
AI rationale
The package automatically follows a hard-coded WhatsApp newsletter after socket construction, using the user's authenticated account without consent. This is an unrequested account action toward a publisher-selected target.
Evidence
lib/Socket/messages-send.jslib/Socket/newsletter.jslib/WABinary/jid-utils.js
Network endpoints1
@s.whatsapp.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Constructing the message socket constructs the newsletter layer, which schedules an automatic action.
- After 90 seconds, the timer decodes a hard-coded newsletter ID and sends a FOLLOW query; the ID is 120363423170424828@newsletter.
- The query uses WhatsApp's w:mex protocol over the package's WhatsApp connection.
Evidence against
- package.json has no lifecycle scripts.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js8.08 MB file, sampled 256 KB
Source & flagged code
6 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh
kind = build_helper
sizeBytes = 301
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgFindings
4 High5 Medium3 Low
HighHigh Secretlib/WABinary/constants.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.5.0.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.