@ubedsockets/baileys@1.7.9
@ubedsockets/baileys,baileys A high-performance WhatsApp Web API wrapper based on Baileys, optimized for bot developers with integrated utility scrapers.
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package automatically uses the user's WhatsApp credentials to follow a hard-coded newsletter when its connection opens, an account action the user did not request. Its socket setup also imposes an unrelated IP allowlist and exits the host process when the check fails.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The application creates the normal Baileys socket and its WhatsApp connection opens.
Impact
The user's WhatsApp account is made to follow a publisher-chosen target without consent, and ordinary applications may be forcibly terminated based on their public IP.
Mechanism
The newsletter socket registers a connection.update handler that subscribes the authenticated account to a hard-coded newsletter. Separately, makeSocket requests the public IP from api.ipify.org and terminates the process on a failed or disallowed check.
Attack narrative
Creating the package's normal socket stack registers a connection-open handler that checks whether the authenticated WhatsApp account follows newsletter 120363410154606795@newsletter and follows it if not. This publisher-selected account action happens automatically, without a user request. Socket creation also checks the host's public IP through api.ipify.org and exits the application if verification fails or the IP is outside a hard-coded allowlist.
AI rationale
The package automatically uses the user's WhatsApp credentials to follow a hard-coded newsletter when its connection opens, an account action the user did not request. Its socket setup also imposes an unrelated IP allowlist and exits the host process when the check fails.
Evidence
lib/Socket/index.jslib/Socket/messages-send.jslib/Socket/newsletter.jslib/Socket/socket.js
Network endpoints2
api.ipify.orgWABinary.S_WHATSAPP_NET (WhatsApp)
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entry point is lib/index.js and package.json declares no lifecycle scripts.
- The default makeWASocket creates the normal business socket stack.
- The message socket constructs the newsletter socket as part of socket creation.
- When the WhatsApp connection opens, the code checks a hard-coded newsletter and follows it if the account is not already subscribed.
- Creating the base socket also sends a request to api.ipify.org and exits the host process if the IP check fails or the IP is not allowlisted.
Evidence against
- The package is described as a WhatsApp Web API wrapper, so connecting to WhatsApp is expected.
- The manifest has no install lifecycle scripts.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
11 flaggedlib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603lib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = @ubedsockets/baileys@1.7.12
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:QHViZWRzb2NrZXRzL2JhaWxleXM:1.7.12
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Findings
6 High8 Medium4 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Socket/messages-send.js#virtual:normalized:round1
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumUnsafe Vm Contextlib/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
Affected versions and remediation
This report applies to @ubedsockets/baileys@1.7.9.
See all versions of @ubedsockets/baileys for other recorded verdicts.
- Avoid installing @ubedsockets/baileys@1.7.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.