@ubedsockets/baileys@1.7.0
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe standard socket automatically follows a hard-coded WhatsApp newsletter when the connection opens. This is an unsolicited account action using the user's authenticated session, so the package is malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A client creates the standard socket and its WhatsApp connection opens.
Impact
Subscribes the user's account to a channel the package publisher selected without the user's request.
Mechanism
The newsletter socket checks the account's subscription status and sends a follow query for a hard-coded newsletter if not already followed.
Attack narrative
When the standard socket connects, the package checks whether the account follows newsletter 120363410154606795@newsletter and sends a follow query if it does not. This uses the user's authenticated WhatsApp session to perform an account action toward a publisher-selected target without a user request.
AI rationale
The standard socket automatically follows a hard-coded WhatsApp newsletter when the connection opens. This is an unsolicited account action using the user's authenticated session, so the package is malicious.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/index.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The socket registers a handler that checks whether the account follows the hard-coded newsletter JID 120363410154606795@newsletter when the connection opens, then sends a follow query if it does not.
- The normal socket construction path creates the newsletter socket, so the automatic follow runs for clients using the package's standard socket.
Evidence against
- The package describes itself as a WhatsApp Web API wrapper, and its normal purpose includes WhatsApp socket operations.
- The preinstall script only checks the Node.js major version and exits if it is below 20.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Findings
7 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumUnsafe Vm Contextlib/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build Helperlib/Signal/libsignalnode/generate-proto.sh
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.7.0.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.7.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.