@vanzxy/baileys
Enhanced Baileys fork by Vanzxy — based on @itsliaaa/baileys + @whiskeysockets/baileys with fixes for audio group status and clean media without newsletter button.
This report shows the evidence for @vanzxy/baileys@1.4.6. 1 of 21 known versions is blocked or flagged. The newest version, 2.0.4, is allowed. See all versions.
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource establishes a concrete default runtime action that alters a user's WhatsApp subscription. Lifecycle scripts themselves are benign, but do not mitigate the unsolicited follow behavior.
Decision evidence
public snapshot- Default socket creation schedules automatic following of a hard-coded newsletter.
- On connection, it sends a WhatsApp FOLLOW query without user consent.
- The behavior is enabled by default; only an explicit false setting disables it.
- Install hooks only enforce Node 20+ and print a banner.
- No credential harvesting, shell payload, or install-time network activity found.
- Other network/file functions support WhatsApp messaging and user-supplied media.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/WABinary/constants.jsView on unpkgGoogle API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Package source references weak cryptographic algorithms.
lib/Utils/crypto.jsView on unpkg · L1Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/Utils/business.jsView on unpkgGoogle API key in cjs/lib/WABinary/constants.js
cjs/lib/WABinary/constants.jsView on unpkg · L603Findings
Affected versions and remediation
This report applies to @vanzxy/baileys@1.4.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing @vanzxy/baileys@1.4.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.