registry / @vanzxy/baileys / 1.6.0
@vanzxy/baileys@1.6.0
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect inspection found benign lifecycle scripts and package-aligned WhatsApp networking. Static similarity and token-string hints correspond to protocol/media code, not a concrete malicious chain.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm install or explicit application use of the WhatsApp client
Impact
No credential harvesting, exfiltration, remote payload execution, persistence, or destructive behavior established.
Mechanism
Node version gate, console banner, and user-invoked WhatsApp networking
AI rationale
Direct inspection found benign lifecycle scripts and package-aligned WhatsApp networking. Static similarity and token-string hints correspond to protocol/media code, not a concrete malicious chain.
Evidence
package.jsonengine-requirements.jspostinstall-banner.jslib/Utils/messages-media.jslib/Utils/generics.jslib/Socket/Client/websocket.js
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Install-time hooks are present and were inspected.
- Preinstall only enforces Node.js 20+.
- Postinstall reads its own manifest version and prints a banner.
Evidence against
- No install-time network access, shell execution, payload loading, or file mutation found.
- Runtime WebSocket and media uploads are WhatsApp-client functionality.
- The ffmpeg spawn uses a fixed executable and argument array for video thumbnails.
- The GitHub fetch only parses a version tuple; it does not execute downloaded content.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
matchedText = 'AIzaSyD...Lk',
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600•matchType = normalized_sha256
matchedPackage = @vanzxy/baileys@1.4.6
matchedPath = lib/WABinary/constants.js
matchedIdentity = npm:QHZhbnp4eS9iYWlsZXlz:1.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/WABinary/constants.jsFindings
6 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/Utils/crypto.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @vanzxy/baileys@1.6.0.
See all versions of @vanzxy/baileys for other recorded verdicts.
- Review the evidence and your use of @vanzxy/baileys@1.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.