@zeronexcode/baileys: Malicious npm security report (Block)

Loading npm security reports…

@zeronexcode/baileys: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "types": "lib/index.d.ts",

21 "files": [

22 "lib/**/*",

23 "WAProto/**/*",

24 "engine-requirements.js"

25 ],

26 "scripts": {

27 "build:all": "npm run build && npm run build:docs",

28 "build:docs": "typedoc",

29 "build": "tsc -P tsconfig.build.json && tsc-esm-fix --tsconfig=tsconfig.build.json --ext=.js",

30 "changelog:last": "conventional-changelog -p angular -r 2",

31 "changelog:preview": "conventional-changelog -p angular -u",

32 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

33 "example": "tsx ./Example/example.ts",

34 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

35 "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",

36 "lint": "tsc && eslint src --ext .js,.ts",

37 "lint:fix": "npm run format && npm run lint -- --fix",

38 "prepack": "npm run build",

39 "prepare": "npm run build",

40 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "release": "release-it",

42 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'",

43 "test:e2e": "NODE_TLS_REJECT_UNAUTHORIZED=0 node --experimental-vm-modules ./node_modules/.bin/jest --runInBand --forceExit --testMatch '**/*.test-e2e.ts'",

44 "update:version": "tsx ./scripts/update-version.ts"

45 },

46 "dependencies": {

47 "@cacheable/node-cache": "^1.4.0",

48 "@hapi/boom": "^9.1.3",

49 "async-mutex": "^0.5.0",

50 "libsignal": "^6.0.0",

51 "lru-cache": "^11.1.0",

52 "music-metadata": "^11.12.3",

53 "p-queue": "^9.0.0",

54 "pino": "^9.6",

55 "protobufjs": "^7.5.6",

56 "whatsapp-rust-bridge": "0.5.4",

57 "ws": "^8.13.0"

58 },

59 "devDependencies": {

60 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 94-134javascript

94 supportBizHostedMsg: true,

95 supportRecentSyncChunkMessageCountTuning: true,

96 supportHostedGroupMsg: true,

97 supportFbidBotChatHistory: true,

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @lekzo/baileys@0.0.6 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGxla3pvL2JhaWxleXM:0.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/validate-connection.jsView file

114pull: false, L115: devicePairingData: { L116: buildHash: appVersionBuf, ... L141: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L142: let hmacPrefix = Buffer.from([]); L143: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L165: ]); L166: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L167: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L114

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Source & flagged code

9 flagged

package.jsonView file

Lines 20-60json

20 "types": "lib/index.d.ts",

21 "files": [

22 "lib/**/*",

23 "WAProto/**/*",

24 "engine-requirements.js"

25 ],

26 "scripts": {

27 "build:all": "npm run build && npm run build:docs",

28 "build:docs": "typedoc",

29 "build": "tsc -P tsconfig.build.json && tsc-esm-fix --tsconfig=tsconfig.build.json --ext=.js",

30 "changelog:last": "conventional-changelog -p angular -r 2",

31 "changelog:preview": "conventional-changelog -p angular -u",

32 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

33 "example": "tsx ./Example/example.ts",

34 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

35 "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",

36 "lint": "tsc && eslint src --ext .js,.ts",

37 "lint:fix": "npm run format && npm run lint -- --fix",

38 "prepack": "npm run build",

39 "prepare": "npm run build",

40 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "release": "release-it",

42 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'",

43 "test:e2e": "NODE_TLS_REJECT_UNAUTHORIZED=0 node --experimental-vm-modules ./node_modules/.bin/jest --runInBand --forceExit --testMatch '**/*.test-e2e.ts'",

44 "update:version": "tsx ./scripts/update-version.ts"

45 },

46 "dependencies": {

47 "@cacheable/node-cache": "^1.4.0",

48 "@hapi/boom": "^9.1.3",

49 "async-mutex": "^0.5.0",

50 "libsignal": "^6.0.0",

51 "lru-cache": "^11.1.0",

52 "music-metadata": "^11.12.3",

53 "p-queue": "^9.0.0",

54 "pino": "^9.6",

55 "protobufjs": "^7.5.6",

56 "whatsapp-rust-bridge": "0.5.4",

57 "ws": "^8.13.0"

58 },

59 "devDependencies": {

60 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 94-134javascript

94 supportBizHostedMsg: true,

95 supportRecentSyncChunkMessageCountTuning: true,

96 supportHostedGroupMsg: true,

97 supportFbidBotChatHistory: true,

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

@zeronexcode/baileys@7.0.0-zeronex.8

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code