Loading npm security reports…

@viertechjs/wb@6.0.0-vier.6: Malicious npm security report | LPM Firewall

registry / @viertechjs/wb / 6.0.0-vier.6

@viertechjs/wb@6.0.0-vier.6

VierTech WhatsApp Bot toolkit for Baileys

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious chain was recoverable from the obfuscated listener payloads. Importing the package loads its runtime modules, while opaque code can conceal behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Application import and WhatsApp listener runtime use.

Impact

Unresolved runtime behavior; no specific theft, persistence, or destruction confirmed.

Mechanism

Obfuscated runtime payload with dynamic code-construction primitive.

Rationale

Warn because executable, dynamically constructed behavior is concealed by pervasive obfuscation, but source inspection did not establish a concrete malicious action. Do not block absent confirmed exfiltration, persistence, destructive behavior, or install-time abuse.

Evidence

package.jsonlib/index.jslib/listener/groups-update.jslib/utils/sticker-pack.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15832

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @viertechjs/wb (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (e5c7eed79e04104fa70a24bc54a748194a7d858fc491a943e71751ec4355eed5) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source & flagged code

5 flagged

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/listener/groups-update.jsView file

1var i=O;function O(r,g){var b=W();return O=function(k,S){

High

Ai Review Evidence

Listener source is heavily obfuscated into single-line decoder payloads.

lib/listener/groups-update.jsView on unpkg · L1

1ength,zg6J','Function(z','+\x22:\x22,sxyKM

High

Ai Review Evidence

Obfuscation includes dynamic Function-constructor primitives, preventing reliable source attribution.

lib/listener/groups-update.jsView on unpkg · L1

Source & flagged code

5 flagged · loading source

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/listener/groups-update.jsView file

1var i=O;function O(r,g){var b=W();return O=function(k,S){

High

Ai Review Evidence

Listener source is heavily obfuscated into single-line decoder payloads.

lib/listener/groups-update.jsView on unpkg · L1

1ength,zg6J','Function(z','+\x22:\x22,sxyKM

High

Ai Review Evidence

Obfuscation includes dynamic Function-constructor primitives, preventing reliable source attribution.

lib/listener/groups-update.jsView on unpkg · L1

@viertechjs/wb@6.0.0-vier.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code