@vanzxy/baileys@1.4.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@vanzxy/baileys@1.4.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = normalized_sha256 matchedPackage = @lordmega/baileys@0.3.40 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:QGxvcmRtZWdhL2JhaWxleXM:0.3.40 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/crypto.jsView file

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto'; L2: import * as curve from 'libsignal/src/curve.js'; ... L42: return { L43: private: Buffer.from(privKey), L44: // remove version byte

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5310738 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

cjs/lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in cjs/lib/WABinary/constants.js

cjs/lib/WABinary/constants.jsView on unpkg · L603

Source & flagged code

8 flagged

package.jsonView file

Lines 1-39json

1{

2 "name": "@vanzxy/baileys",

3 "version": "1.4.6",

4 "description": "Enhanced Baileys fork by Vanzxy — based on @itsliaaa/baileys + @whiskeysockets/baileys with fixes for audio group status and clean media without newsletter button.",

5 "type": "module",

6 "main": "./cjs/lib/index.js",

7 "module": "./lib/index.js",

8 "types": "./lib/index.d.ts",

9 "exports": {

10 ".": {

11 "types": "./lib/index.d.ts",

12 "import": "./lib/index.js",

13 "require": "./cjs/lib/index.js",

14 "default": "./lib/index.js"

15 },

16 "./package.json": "./package.json"

17 },

18 "scripts": {

19 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L19

20 "postinstall": "node ./postinstall-banner.js"

21 },

22 "engines": {

23 "node": ">=20.0.0"

24 },

25 "repository": {

26 "type": "git",

27 "url": "git+https://github.com/vanzxy/baileys.git"

28 },

29 "files": [

30 "lib/**/*",

31 "cjs/**/*",

32 "WAProto/**/*",

33 "engine-requirements.js",

34 "postinstall-banner.js",

35 "NOTICE.md"

36 ],

37 "keywords": [

38 "automation",

39 "baileys",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/crypto.jsView file

Lines 1-21javascript

1import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';

2import * as curve from 'libsignal/src/curve.js';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L1

3import { KEY_BUNDLE_TYPE } from

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5310738 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

cjs/lib/WABinary/constants.jsView file

Lines 583-623javascript

583 '044',

584 'mms_cat_v1_forward_hot_override_enabled',

585 'user_notice',

586 'ptt_waveform_send',

587 '047',

588 'Asia/Calcutta',

589