registry / @zervonex/baileys / 3.0.3

@zervonex/baileys@3.0.3

Advanced WhatsApp Web API built on Baileys — interactive messages, buttons, carousels, products, events, payments, polls, albums, sticker packs and more.

This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Source inspection found no concrete malicious behavior. The flagged files contain package-aligned WhatsApp protocol, authentication-state, parser, and media functionality; the lifecycle scripts do not perform a consumer-project mutation or network transfer.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Installation runs the preinstall engine check; importing the media module initializes its temporary directory.

Impact

The observed effects are a compatibility check and temporary-file setup; no malicious transfer or other attack behavior was established.

Mechanism

The preinstall script checks the Node.js major version and exits when it is below 20. Media code creates a temporary directory and sets image-library temporary-directory variables.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json runs an engine-version check on preinstall and a message-only prepare script; the check exits for Node versions below 20.
lib/WAM/constants.js contains WhatsApp event definitions, and lib/WABinary/constants.js maps storage protocols to Keyv adapters.
WAProto/parser.js parses protocol bundles with Acorn; it is source-generation tooling, not an install hook.
lib/Utils/messages-media.js creates a package temporary directory for media processing and sets related image-library environment variables.
lib/Utils/use-multi-file-auth-state.js reads and writes auth state in the caller-provided folder; lib/Utils/validate-connection.js builds a WhatsApp login payload from the supplied user ID and config.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 120 file(s), 1.74 MB of source, external domains: a2ui.org, call.whatsapp.com, graph.whatsapp.com, latex.codecogs.com, mmg.whatsapp.net, raw.githubusercontent.com, v.whatsapp.net, wa.me, web.whatsapp.com, www.instagram.com, www.whatsapp.com

Source & flagged code

7 flagged

package.jsonView file

Lines 70-110json

70 "url": "git+https://github.com/nexustechpro2/baileys.git"

71 },

72 "license": "MIT",

73 "author": "zervonex",

74 "main": "lib/index.js",

75 "types": "lib/index.d.ts",

76 "scripts": {

77 "build:all": "tsc && typedoc",

78 "build:docs": "typedoc",

79 "build:tsc": "tsc",

80 "generate:license": "npx license",

81 "changelog:last": "conventional-changelog -p angular -r 2",

82 "changelog:preview": "conventional-changelog -p angular -u",

83 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

84 "example": "node --inspect -r ts-node/register Example/example.ts",

85 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

86 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

87 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

88 "prepack": "echo 'Zervonex WhatsApp Library'",

89 "prepare": "echo 'Zervonex WhatsApp Library'",

90 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L90

91 "release": "release-it",

92 "test": "jest"

93 },

94 "files": [

95 "lib/**/*.js",

96 "lib/**/*.json",

97 "lib/**/*.d.ts",

98 "lib/**/*.map",

99 "WAProto/**/*.js",

100 "WAProto/**/*.json",

101 "WAProto/**/*.d.ts",

102 "WAProto/**/*.sh",

103 "engine-requirements.js"

104 ],

105 "dependencies": {

106 "@adiwajshing/keyed-db": "^0.2.4",

107 "@cacheable/node-cache": "^1.4.0",

108 "@hapi/boom": "^9.1.3",

109 "@keyv/etcd": "^2.1.1",

110 "@keyv/memcache": "^2.0.2",

lib/WABinary/constants.jsView file

Lines 600-640javascript

600 '044',

601 'mms_cat_v1_forward_hot_override_enabled',

602 'user_notice',

603 'ptt_waveform_send',

604 '047',

605 'Asia/Calcutta',

606

lib/Utils/use-multi-file-auth-state.jsView file

Lines 168-208javascript

168const COLLECTION_OPTION_KEY = {

169 '@keyv/mongo': 'collection',

170 '@keyv/postgres': 'table',

171 '@keyv/mysql': 'table',

172

lib/Utils/validate-connection.jsView file

Lines 78-118javascript

78 recentSyncDaysLimit: undefined,

79 supportCallLogHistory: false,

80 supportBotUserAgentChatHistory: true,

81 supportCagReactionsAndPolls: true,

WAProto/parser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/parser.js#virtual:normalized:round1View on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @zervonex/baileys@3.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QHplcnZvbmV4L2JhaWxleXM:3.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

620patternName = google_api_key severity = high line = 620

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L620

620patternName = google_api_key severity = high line = 620

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L620

lib/Utils/use-multi-file-auth-state.jsView file

188let mod L189: try { mod = await import(pkg) } catch (e) { L190: if (e.code === 'ERR_MODULE_NOT_FOUND') throw new Error(`[Auth] "${pkg}" is required for this backend — install it: npm i ${pkg}`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/use-multi-file-auth-state.jsView on unpkg · L188

lib/Utils/validate-connection.jsView file

98pull: false, L99: devicePairingData: { L100: buildHash: appVersionBuf, ... L129: ? WA_ADV_HOSTED_ACCOUNT_SIG_PREFIX L130: : Buffer.from([]) L131: ... L146: account.deviceSignature = Curve.sign( L147: signedIdentityKey.private, L148: Buffer.concat([WA_ADV_DEVICE_SIG_PREFIX, deviceDetails, signedIdentityKey.public, accountSignatureKey])

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L98

WAProto/parser.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/parser.js#virtual:normalized:round1View on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Findings

5 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighSemantic Analysis LimitedWAProto/parser.js#virtual:normalized:round1

HighKnown Malware Source Similaritylib/Utils/messages-media.js

HighSecret Patternlib/WABinary/constants.js

MediumDynamic Requirelib/Utils/use-multi-file-auth-state.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @zervonex/baileys@3.0.3.

See all versions of @zervonex/baileys for other recorded verdicts.

Review the evidence and your use of @zervonex/baileys@3.0.3 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-18 07:51:16.285Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.