@wanzlonely/bails4u@7.0.0
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe package has a concrete, caller-triggered phone-number transfer to an unrelated host. This supports a warning for conditional data disclosure, but the inspected code does not establish an automatic attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A consumer invokes `checkBan` on the socket object.
Impact
The number is disclosed to that service; the inspected code does not establish the service’s handling of it.
Mechanism
The method removes nonnumeric characters from the number and includes it in a GET request to `kyuux-r.indevs.in`.
AI rationale
The package has a concrete, caller-triggered phone-number transfer to an unrelated host. This supports a warning for conditional data disclosure, but the inspected code does not establish an automatic attack.
Evidence
lib/Socket/socket.js
Network endpoints1
kyuux-r.indevs.in
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Calling `checkBan` sends the supplied phone number to `kyuux-r.indevs.in`.
- The socket object exposes `checkBan` to callers.
- The package entry point loads the socket module.
Evidence against
- The phone-number transfer occurs only when a caller invokes `checkBan`; the inspected code does not show automatic transmission.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js11.6 MB file, sampled 256 KB
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighPrevious Version Dangerous Deltalib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
Low
Affected versions and remediation
This report applies to @wanzlonely/bails4u@7.0.0.
See all versions of @wanzlonely/bails4u for other recorded verdicts.
- Review the evidence and your use of @wanzlonely/bails4u@7.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.