@ubedsockets/baileys@1.7.10
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 14h ago · by lpm-firewall-aiThe source contains an explicit automatic account action toward a publisher-selected WhatsApp channel, which meets the account-action rule. The socket file’s top-level await may make the current snapshot fail before that action runs, but it does not make the embedded behavior benign.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Creating the socket and receiving a WhatsApp connection-open event.
Impact
An account may be made to follow a channel without the user requesting that action. The top-level await in `socket.js` may currently prevent this path from loading.
Mechanism
The newsletter handler checks whether the account follows `120363410154606795@newsletter` and sends a follow query if it does not.
Attack narrative
When the socket layer is built, it installs a newsletter handler that follows a hard-coded channel after connection if the account is not already subscribed. The changed socket file also performs public-IP checks and contains a top-level await that may prevent the CommonJS module from loading in this snapshot.
AI rationale
The source contains an explicit automatic account action toward a publisher-selected WhatsApp channel, which meets the account-action rule. The socket file’s top-level await may make the current snapshot fail before that action runs, but it does not make the embedded behavior benign.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/socket.js
Network endpoints5
api.ipify.orgapi4.ipify.orgipinfo.iocheckip.amazonaws.comWhatsApp newsletter query
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- `makeMessagesSocket` constructs the newsletter socket as part of the socket setup.
- On connection open, the newsletter socket checks a publisher-selected channel and follows it if the account is not already subscribed.
- `socket.js` also contains public-IP lookups and exits unless the detected IP is in a hard-coded allowlist.
- The CommonJS package’s socket file contains a top-level `await verifyIP()`, which may prevent that module from loading in this snapshot.
Evidence against
- `package.json` declares no lifecycle scripts.
- The IP lookup code requests public IP information; it does not show credential collection.
- The top-level await may prevent the socket code, including the newsletter follow path, from running in this snapshot.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
12 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603lib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = @ubedsockets/baileys@1.7.12
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:QHViZWRzb2NrZXRzL2JhaWxleXM:1.7.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Findings
1 Critical6 High8 Medium4 Low
CriticalKnown Malicious Dependency Insertionpackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Socket/messages-send.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumUnsafe Vm Contextlib/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.7.10.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.7.10. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.