@ubedsockets/baileys@1.7.7
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe default socket stack follows a hard-coded newsletter on the user's WhatsApp account when the connection opens, without a user request. This is an unauthorized account action and warrants blocking.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The application creates the default socket and its WhatsApp connection opens.
Impact
The user's WhatsApp account is made to follow a publisher-selected channel without a request from the user.
Mechanism
A connection update handler checks subscription status for 120363410154606795@newsletter, then sends a FOLLOW query if needed.
Attack narrative
Creating the default socket stack registers a connection-open handler. Once the WhatsApp connection opens, the handler checks whether the account follows 120363410154606795@newsletter and sends a FOLLOW request when it does not. This silently uses the user's account to perform a publisher-chosen action.
AI rationale
The default socket stack follows a hard-coded newsletter on the user's WhatsApp account when the connection opens, without a user request. This is an unauthorized account action and warrants blocking.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/index.jsRemote WhatsApp account subscription state for 120363410154606795@newsletter
Network endpoints1
WhatsApp servers (newsletter w:mex query)
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- When a WhatsApp connection opens, the newsletter socket checks a publisher-chosen newsletter ID and follows it if the account is not already subscribed.
- The default message socket constructs the newsletter socket, and the default exported socket uses that socket stack.
- The package is a WhatsApp Web API wrapper, but following this hard-coded newsletter is unrelated to a caller's requested operation.
Evidence against
- The manifest has no lifecycle scripts, so the action is triggered at runtime rather than during installation.
- The package's stated purpose is WhatsApp API access, which explains its WhatsApp network and account operations generally.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
11 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603lib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = @ubedsockets/baileys@1.7.12
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:QHViZWRzb2NrZXRzL2JhaWxleXM:1.7.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Findings
6 High8 Medium4 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Socket/messages-send.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumUnsafe Vm Contextlib/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.7.7.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.7.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.