registry / @vanzxy/baileys / 1.3.9

@vanzxy/baileys@1.3.9

Enhanced Baileys fork by Vanzxy — based on @itsliaaa/baileys + @whiskeysockets/baileys with fixes for audio group status and clean media without newsletter button.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 110 file(s), 1.96 MB of source, external domains: call.whatsapp.com, github.com, raw.githubusercontent.com, stackoverflow.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js5.06 MB file, sampled 256 KB

ChildProcess

Source & flagged code

6 flagged

package.jsonView file

Lines 1-29json

2 "name": "@vanzxy/baileys",

3 "version": "1.3.9",

4 "description": "Enhanced Baileys fork by Vanzxy \u2014 based on @itsliaaa/baileys + @whiskeysockets/baileys with fixes for audio group status and clean media without newsletter button.",

5 "main": "lib/index.js",

6 "types": "lib/index.d.ts",

7 "type": "module",

8 "scripts": {

9 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

10 "postinstall": "node ./postinstall-banner.js"

11 },

12 "engines": {

13 "node": ">=20.0.0"

14 },

15 "repository": {

16 "type": "git",

17 "url": "git+https://github.com/vanzxy/baileys.git"

18 },

19 "files": [

20 "lib/**/*",

21 "WAProto/**/*",

22 "engine-requirements.js",

23 "postinstall-banner.js",

24 "NOTICE.md"

25 ],

26 "keywords": [

27 "automation",

28 "baileys",

29 "bot",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/crypto.jsView file

Lines 1-21javascript

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';

2import * as curve from 'libsignal/src/curve.js';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

3import { KEY_BUNDLE_TYPE } from

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5310738 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code