registry / @vinzsocket/baileys / 3.2.11

@vinzsocket/baileys@3.2.11

A WebSockets library for interacting with WhatsApp Web

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 103 file(s), 1.78 MB of source, external domains: call.whatsapp.com, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js4.23 MB file, sampled 256 KB

ChildProcess

Source & flagged code

8 flagged

package.jsonView file

Lines 17-57json

17 "types": "lib/index.d.ts",

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "build:all": "npm run build && npm run build:docs",

25 "build:docs": "typedoc",

26 "build": "tsc -P tsconfig.build.json && tsc-esm-fix --tsconfig=tsconfig.build.json --ext=.js",

27 "changelog:last": "conventional-changelog -p angular -r 2",

28 "changelog:preview": "conventional-changelog -p angular -u",

29 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

30 "example": "tsx ./Example/example.ts",

31 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

32 "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",

33 "lint": "tsc && eslint src --ext .js,.ts",

34 "lint:fix": "npm run format && npm run lint -- --fix",

35 "-prepack": "npm run build",

36 "-prepare": "npm run build",

37 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 "release": "release-it",

39 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'",

40 "test:e2e": "NODE_TLS_REJECT_UNAUTHORIZED=0 node --experimental-vm-modules ./node_modules/.bin/jest --runInBand --forceExit --testMatch '**/*.test-e2e.ts'",

41 "update:version": "tsx ./scripts/update-version.ts"

42 },

43 "dependencies": {

44 "@cacheable/node-cache": "^1.4.0",

45 "@hapi/boom": "^9.1.3",

46 "async-mutex": "^0.5.0",

47 "libsignal": "^6.0.0",

48 "lru-cache": "^11.1.0",

49 "music-metadata": "^11.12.3",

50 "p-queue": "^9.0.0",

51 "pino": "^9.6",

52 "protobufjs": "^7.5.6",

53 "whatsapp-rust-bridge": "0.5.4",

54 "ws": "^8.13.0"

55 },

56 "devDependencies": {

57 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

engine-requirements.jsView file

Lines 1-22javascript

1const [major, minor] = process.versions.node.split('.').map(Number);

3// require(esm) is only stable on Node 20.19.0+ and 22.12.0+ (and any 23.x+).

4// Below that, `require('@vinzsocket/baileys')` from a CommonJS bot will throw ERR_REQUIRE_ESM.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

engine-requirements.jsView on unpkg · L2

5const supportsRequireEsm =

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

91 supportAddOnHistorySyncMigration: undefined,

92 supportMessageAssociation

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: number;

5 DICTIONARY_2: number;

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

engine-requirements.jsView file

2L3: // require(esm) is only stable on Node 20.19.0+ and 22.12.0+ (and any 23.x+). L4: // Below that, `require('@vinzsocket/baileys')` from a CommonJS bot will throw ERR_REQUIRE_ESM.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

engine-requirements.jsView on unpkg · L2

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Findings

5 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighOversized Source FileWAProto/index.js

HighSecret Patternlib/WABinary/constants.js

HighSecret Patternlib/WABinary/constants.d.ts

MediumDynamic Requireengine-requirements.js

MediumNetwork

MediumShips Build HelperWAProto/GenerateStatics.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 17-57json

17 "types": "lib/index.d.ts",

18 "files": [

19 "lib/**/*",

20 "WAProto/**/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "build:all": "npm run build && npm run build:docs",

25 "build:docs": "typedoc",

26 "build": "tsc -P tsconfig.build.json && tsc-esm-fix --tsconfig=tsconfig.build.json --ext=.js",

27 "changelog:last": "conventional-changelog -p angular -r 2",

28 "changelog:preview": "conventional-changelog -p angular -u",

29 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

30 "example": "tsx ./Example/example.ts",

31 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

32 "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",

33 "lint": "tsc && eslint src --ext .js,.ts",

34 "lint:fix": "npm run format && npm run lint -- --fix",

35 "-prepack": "npm run build",

36 "-prepare": "npm run build",

37 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 "release": "release-it",

39 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'",

40 "test:e2e": "NODE_TLS_REJECT_UNAUTHORIZED=0 node --experimental-vm-modules ./node_modules/.bin/jest --runInBand --forceExit --testMatch '**/*.test-e2e.ts'",

41 "update:version": "tsx ./scripts/update-version.ts"

42 },

43 "dependencies": {

44 "@cacheable/node-cache": "^1.4.0",

45 "@hapi/boom": "^9.1.3",

46 "async-mutex": "^0.5.0",

47 "libsignal": "^6.0.0",

48 "lru-cache": "^11.1.0",

49 "music-metadata": "^11.12.3",

50 "p-queue": "^9.0.0",

51 "pino": "^9.6",

52 "protobufjs": "^7.5.6",

53 "whatsapp-rust-bridge": "0.5.4",

54 "ws": "^8.13.0"

55 },

56 "devDependencies": {

57 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

engine-requirements.jsView file

Lines 1-22javascript

1const [major, minor] = process.versions.node.split('.').map(Number);

3// require(esm) is only stable on Node 20.19.0+ and 22.12.0+ (and any 23.x+).

4// Below that, `require('@vinzsocket/baileys')` from a CommonJS bot will throw ERR_REQUIRE_ESM.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

engine-requirements.jsView on unpkg · L2

5const supportsRequireEsm =

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

91 supportAddOnHistorySyncMigration: undefined,

92 supportMessageAssociation

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: number;

5 DICTIONARY_2: number;