registry  /  @vinnxcode/xbailsync  /  1.0.1

@vinnxcode/xbailsync@1.0.1

A WebSockets library for interacting with WhatsApp Web

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Preinstall only checks the local Node.js major version; runtime networking implements the package’s WhatsApp Web client behavior.

Static reason
One or more suspicious static signals were detected.
Trigger
Install runs the Node.js version check; runtime WhatsApp client and media APIs are explicitly invoked by the consumer.
Impact
No unconsented execution, exfiltration, destructive action, or AI-agent control-surface mutation found.
Mechanism
Package-aligned WhatsApp WebSocket, GraphQL, media, and auth-state operations.
Rationale
Source inspection shows a WhatsApp Web client library with a benign Node-version preinstall check and package-aligned runtime networking. The detected shell use is for thumbnail generation using internally generated temporary paths, not an install-time payload or persistence chain.
Evidence
package.jsonengine-requirements.jslib/index.jslib/Socket/Client/websocket.jslib/Socket/graphql.jslib/Utils/messages.jslib/Utils/messages-media.jslib/Utils/use-multi-file-auth-state.jslib/Utils/generics.jsWAProto/GenerateStatics.shWAProto/fix-imports.js
Network endpoints4
wss://web.whatsapp.com/ws/chatgraph.whatsapp.com/graphqlacs.whatsapp.com/graphqlraw.githubusercontent.com/WhiskeySockets/Baileys/master/src/Defaults/index.ts

Decision evidence

public snapshot
AI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for block
  • `lib/Utils/messages-media.js` invokes `ffmpeg` for video thumbnails.
  • `lib/index.js` prints a promotional banner on import.
Evidence against
  • `engine-requirements.js` only enforces Node.js 20+ during preinstall.
  • No install hook writes files, runs network calls, or mutates agent configuration.
  • `lib/Utils/messages.js` passes generated temporary paths to thumbnail processing.
  • Network code targets WhatsApp services and an explicit Baileys version helper.
  • `lib/Utils/use-multi-file-auth-state.js` confines persistence to the caller-supplied auth folder.
  • No credential/environment harvesting, eval, remote payload loader, or persistence mechanism found.
Behavioral surface
Source
ChildProcessCryptoFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 117 file(s), 1.90 MB of source, external domains: acs.whatsapp.com, call.whatsapp.com, graph.whatsapp.com, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com
Oversized source lightweight scan
WAProto/index.js11.6 MB file, sampled 256 KB
ChildProcess

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
lib/WABinary/constants.jsView file
600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',
High
High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600
600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',
High
Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600
lib/Utils/validate-connection.jsView file
107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);
Low
Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107
WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg
WAProto/index.jsView file
•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]
High
Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

Findings

4 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighOversized Source FileWAProto/index.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings