@xayz/baileys@6.0.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@xayz/baileys@6.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/native-bridge.jsView file

10L11: const require = createRequire(import.meta.url); L12: const BRIDGE_NAME = 'whatsapp-rust-bridge';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/native-bridge.jsView on unpkg · L10

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8100533 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @alannxd/baileys@6.2.7 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGFsYW5ueGQvYmFpbGV5cw:6.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 21-61json

21 "license": "MIT",

22 "author": "XYCoolcraft",

23 "main": "lib/index.js",

24 "types": "lib/index.d.ts",

25 "files": [

26 "lib/**/*",

27 "WAProto/**/*",

28 "engine-requirements.js"

29 ],

30 "scripts": {

31 "build:all": "tsc && typedoc",

32 "build:docs": "typedoc",

33 "build:tsc": "tsc",

34 "changelog:last": "conventional-changelog -p angular -r 2",

35 "changelog:preview": "conventional-changelog -p angular -u",

36 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

37 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

38 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

39 "prepack": "",

40 "prepare": "",

41 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

42 "release": "release-it",

43 "test": "jest",

44 "publish:npm": "bash upload-npm.sh"

45 },

46 "dependencies": {

47 "@cacheable/node-cache": "^1.4.0",

48 "@hapi/boom": "^9.1.3",

49 "async-mutex": "^0.5.0",

50 "libsignal": "npm:@xayz/libsignal-node@latest",

51 "lru-cache": "^11.1.0",

52 "music-metadata": "^11.12.3",

53 "p-queue": "^9.0.0",

54 "pino": "^9.6",

55 "protobufjs": "^8.8.0",

56 "whatsapp-rust-bridge": "0.5.4",

57 "ws": "^8.13.0",

58 "chalk": "^4.1.2",

59 "cache-manager": "^7.2.8"

60 },

61 "devDependencies": {

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/native-bridge.jsView file

Lines 1-30javascript

1/**

2 * lib/Utils/native-bridge.js — best-effort loader for the optional

3 * `whatsapp-rust-bridge` native addon. If it isn't installed (it's an

4 * optional dependency), every function here just returns null instead of

5 * throwing, so nothing breaks for people who don't need it.

6 */

7import fs from 'fs';

8import path from

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

91

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8100533 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @alannxd/baileys@6.2.7 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGFsYW5ueGQvYmFpbGV5cw:6.2.7 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg