@ubedsockets/baileys@1.6.4
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package automatically performs a WhatsApp account action toward a hardcoded publisher-selected newsletter whenever its default socket is constructed. This meets the malicious account-action rule; the auto-follow is unrelated to an explicit user request.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Calling makeWASocket; the follow request is scheduled 90 seconds after newsletter socket construction.
Impact
The user’s WhatsApp account follows a target chosen by the package publisher without an explicit request.
Mechanism
A hardcoded base64 newsletter ID is decoded and passed to a WhatsApp newsletter FOLLOW query.
Attack narrative
Creating the package’s default WhatsApp socket constructs the newsletter layer, which schedules a follow request after 90 seconds. The request decodes a hardcoded newsletter ID and follows that publisher-selected target using the user’s account, without an explicit request.
AI rationale
The package automatically performs a WhatsApp account action toward a hardcoded publisher-selected newsletter whenever its default socket is constructed. This meets the malicious account-action rule; the auto-follow is unrelated to an explicit user request.
Evidence
lib/Socket/index.jslib/Socket/business.jslib/Socket/messages-recv.jslib/Socket/messages-send.jslib/Socket/newsletter.js
Network endpoints1
s.whatsapp.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package’s main entry is lib/index.js, and package.json defines no lifecycle scripts.
- The default makeWASocket factory constructs the business, receive, message-send, and newsletter socket layers.
- lib/Socket/newsletter.js hardcodes a newsletter ID in base64.
- During newsletter socket construction, a 90-second timer decodes that ID and sends a FOLLOW request without an explicit user action.
- The request uses the WhatsApp newsletter protocol and targets the WhatsApp service.
Evidence against
- No install-time scripts are defined.
- The inspected follow behavior does not itself show credential or file exfiltration.
- WhatsApp network access is expected for a WhatsApp API wrapper.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
7 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh
kind = build_helper
sizeBytes = 302
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgFindings
5 High5 Medium3 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.6.4.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.6.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.