registry / @vanzxy/baileys / 1.3.6

@vanzxy/baileys@1.3.6

Enhanced Baileys fork by Vanzxy — based on @itsliaaa/baileys + @whiskeysockets/baileys with fixes for audio group status and clean media without newsletter button.

Static Scan Results

scanned 25d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 108 file(s), 1.90 MB of source, external domains: call.whatsapp.com, raw.githubusercontent.com, stackoverflow.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js5.06 MB file, sampled 256 KB

ChildProcess

Source & flagged code

5 flagged

package.jsonView file

Lines 1-29json

2 "name": "@vanzxy/baileys",

3 "version": "1.3.6",

4 "description": "Enhanced Baileys fork by Vanzxy — based on @itsliaaa/baileys + @whiskeysockets/baileys with fixes for audio group status and clean media without newsletter button.",

5 "main": "lib/index.js",

6 "types": "lib/index.d.ts",

7 "type": "module",

8 "scripts": {

9 "preinstall": "node ./engine-requirements.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 },

11 "engines": {

12 "node": ">=20.0.0"

13 },

14 "repository": {

15 "type": "git",

16 "url": "git+https://github.com/vanzxy/baileys.git"

17 },

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "keywords": [

24 "automation",

25 "baileys",

26 "bot",

27 "interactive-messages",

28 "js-whatsapp",

29 "multi-device",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/crypto.jsView file

Lines 1-21javascript

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';

2import * as curve from 'libsignal/src/curve.js';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

3import { KEY_BUNDLE_TYPE } from

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5310738 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code