@ubedsockets/baileys@1.7.2
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe standard socket path automatically follows a hard-coded WhatsApp newsletter using the user's account when the connection opens. This is an unrequested account action toward a publisher-selected target, which meets the malicious account-action rule.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller creates the standard socket and its WhatsApp connection opens.
Impact
The package performs an account action the user did not request, boosting the selected newsletter.
Mechanism
The connection handler checks the account's subscription status, then sends a newsletter FOLLOW request for a hard-coded target when needed.
Attack narrative
When a normal socket connection opens, the package checks whether the account follows a fixed WhatsApp newsletter and follows it automatically if not. The standard socket construction path includes this handler, so using the package can take an account action toward a publisher-chosen target without the user's request.
AI rationale
The standard socket path automatically follows a hard-coded WhatsApp newsletter using the user's account when the connection opens. This is an unrequested account action toward a publisher-selected target, which meets the malicious account-action rule.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/messages-recv.jslib/Socket/business.jslib/Socket/index.jslib/Socket/socket.js
Network endpoints2
api.ipify.orgWhatsApp server via the configured WebSocket connection
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- When the WhatsApp connection opens, the code checks whether the account follows the hard-coded newsletter `120363410154606795@newsletter` and sends a FOLLOW request if it does not.
- The normal `makeWASocket` path constructs the business, receive, message, and newsletter sockets, so the automatic follow is part of ordinary socket use.
- Socket initialization also queries `api.ipify.org` and exits unless the public IP matches a hard-coded address.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Findings
6 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumUnsafe Vm Contextlib/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build Helperlib/Signal/libsignalnode/generate-proto.sh
MediumOversized Source FileWAProto/index.js
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.7.2.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.7.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.