@ubedsockets/baileys@1.6.1
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package automatically uses the user's WhatsApp account to follow a publisher-selected newsletter when a socket is created, and also sends default reactions to newsletter messages. The unrequested follow is concrete account-abuse behavior, despite the package's legitimate WhatsApp client purpose.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Creating a WhatsApp socket; the follow occurs after 90 seconds, and reactions occur when newsletter messages are processed.
Impact
Uses the user's WhatsApp account to follow a target selected by the package publisher and to react to newsletter messages without the user's request.
Mechanism
The newsletter socket decodes a hard-coded newsletter ID and sends a FOLLOW query. A default-enabled handler also sends a thumbs-up reaction for messages with a server ID.
Attack narrative
When an application creates the package's normal WhatsApp socket, the newsletter layer schedules a follow action for a hard-coded newsletter after 90 seconds. It also reacts to fetched newsletter messages by default. These account actions use the user's WhatsApp session without an explicit request.
AI rationale
The package automatically uses the user's WhatsApp account to follow a publisher-selected newsletter when a socket is created, and also sends default reactions to newsletter messages. The unrequested follow is concrete account-abuse behavior, despite the package's legitimate WhatsApp client purpose.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/index.js
Network endpoints1
WhatsApp newsletter protocol, through the configured WhatsApp socket
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- Creating the package’s socket constructs the newsletter socket as part of the normal send-socket setup.
- Newsletter reactions are enabled by default and sent for fetched newsletter messages.
- A 90-second timer decodes a hard-coded newsletter ID and issues a FOLLOW query automatically.
- The package entry point exports makeWASocket, which creates the socket used by that setup.
Evidence against
- The package is described as a WhatsApp Web API wrapper, so WhatsApp network and newsletter protocol code are expected.
- The manifest defines no lifecycle scripts.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
7 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh
kind = build_helper
sizeBytes = 301
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgFindings
5 High5 Medium3 Low
HighHigh Secretlib/WABinary/constants.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.6.1.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.6.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.