registry / @zervonex/baileys / 3.0.2

@zervonex/baileys@3.0.2

This version has been deprecated, please use 3.0.3 or later

Advanced WhatsApp Web API built on Baileys — interactive messages, buttons, carousels, products, events, payments, polls, albums, sticker packs and more.

This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection found no concrete attack behavior. The lifecycle hook is a Node version check, and the runtime's conditional proto refresh is package-aligned schema maintenance rather than payload execution.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Package installation runs the preinstall version check; proto retrieval occurs at runtime if required proto files are missing or invalid.

Impact

No confirmed harmful effect; the install hook only rejects unsupported Node versions and proto refresh supports normal library operation.

Mechanism

The runtime fetches schema input from the package repository and parses it for generated protocol tables; the inspected parser does not execute the downloaded bundle.

AI rationale

Evidence

engine-requirements.jsWAProto/WAProto.protoWAProto/WAProto.json

Network endpoints1

raw.githubusercontent.com/nexustechpro2/baileys/wa-cache

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The preinstall hook runs a Node version check that exits only when Node is below version 20.
The runtime entrypoint is the WhatsApp client; its proto bootstrap uses existing files when valid and fetches a replacement only when proto data is missing or invalid.
Proto parsing uses Acorn to parse bundle source into syntax trees for schema extraction; inspected code does not execute the bundle.
The media helper creates a local temporary directory for media processing.
The flagged WAM and WABinary files contain event and protocol constant tables.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 120 file(s), 1.74 MB of source, external domains: a2ui.org, call.whatsapp.com, graph.whatsapp.com, latex.codecogs.com, mmg.whatsapp.net, raw.githubusercontent.com, v.whatsapp.net, wa.me, web.whatsapp.com, www.instagram.com, www.whatsapp.com

Source & flagged code

7 flagged

package.jsonView file

Lines 70-110json

70 "url": "git+https://github.com/nexustechpro2/baileys.git"

71 },

72 "license": "MIT",

73 "author": "zervonex",

74 "main": "lib/index.js",

75 "types": "lib/index.d.ts",

76 "scripts": {

77 "build:all": "tsc && typedoc",

78 "build:docs": "typedoc",

79 "build:tsc": "tsc",

80 "generate:license": "npx license",

81 "changelog:last": "conventional-changelog -p angular -r 2",

82 "changelog:preview": "conventional-changelog -p angular -u",

83 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

84 "example": "node --inspect -r ts-node/register Example/example.ts",

85 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

86 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

87 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

88 "prepack": "echo 'Zervonex WhatsApp Library'",

89 "prepare": "echo 'Zervonex WhatsApp Library'",

90 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L90

91 "release": "release-it",

92 "test": "jest"

93 },

94 "files": [

95 "lib/**/*.js",

96 "lib/**/*.json",

97 "lib/**/*.d.ts",

98 "lib/**/*.map",

99 "WAProto/**/*.js",

100 "WAProto/**/*.json",

101 "WAProto/**/*.d.ts",

102 "WAProto/**/*.sh",

103 "engine-requirements.js"

104 ],

105 "dependencies": {

106 "@adiwajshing/keyed-db": "^0.2.4",

107 "@cacheable/node-cache": "^1.4.0",

108 "@hapi/boom": "^9.1.3",

109 "@keyv/etcd": "^2.1.1",

110 "@keyv/memcache": "^2.0.2",

lib/WABinary/constants.jsView file

Lines 600-640javascript

600 '044',

601 'mms_cat_v1_forward_hot_override_enabled',

602 'user_notice',

603 'ptt_waveform_send',

604 '047',

605 'Asia/Calcutta',

606

lib/Utils/use-multi-file-auth-state.jsView file

Lines 168-208javascript

168const COLLECTION_OPTION_KEY = {

169 '@keyv/mongo': 'collection',

170 '@keyv/postgres': 'table',

171 '@keyv/mysql': 'table',

172

lib/Utils/validate-connection.jsView file

Lines 78-118javascript

78 recentSyncDaysLimit: undefined,

79 supportCallLogHistory: false,

80 supportBotUserAgentChatHistory: true,

81 supportCagReactionsAndPolls: true,

WAProto/parser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/parser.js#virtual:normalized:round1View on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @zervonex/baileys@3.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QHplcnZvbmV4L2JhaWxleXM:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

620patternName = google_api_key severity = high line = 620

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L620

620patternName = google_api_key severity = high line = 620

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L620

Findings

5 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighSemantic Analysis LimitedWAProto/parser.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/Utils/messages-media.js

HighSecret Patternlib/WABinary/constants.js

MediumDynamic Requirelib/Utils/use-multi-file-auth-state.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

Affected versions and remediation

This report applies to @zervonex/baileys@3.0.2.

See all versions of @zervonex/baileys for other recorded verdicts.

Review the evidence and your use of @zervonex/baileys@3.0.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 07:19:46.426Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.