aemeath-baileys@1.1.13
Aemeath Baileys WhatsApp Web API Library
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe package performs publisher-selected WhatsApp account actions automatically whenever a connected socket opens. The normal socket construction path activates the behavior, so this is an unsolicited account-action attack.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A connected socket emits `connection.update` with connection `open`; the actions run after a 30-second delay.
Impact
The user’s account joins and mutes channels without an explicit request, an unsolicited account action chosen by the package publisher.
Mechanism
The socket sends newsletter FOLLOW and MUTE protocol queries for hard-coded newsletter IDs. A second handler repeats follow and mute for one encoded ID.
Attack narrative
When a WhatsApp socket connects, the package automatically follows and mutes three hard-coded newsletters after 30 seconds. Its normal socket construction includes the newsletter layer, and another handler contains an encoded repeat of the follow and mute behavior. These actions use the user’s connected account without an explicit request.
AI rationale
The package performs publisher-selected WhatsApp account actions automatically whenever a connected socket opens. The normal socket construction path activates the behavior, so this is an unsolicited account-action attack.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/messages-recv.jslib/Socket/index.js
Network endpoints1
WhatsApp newsletter protocol via the connected WhatsApp socket
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- When the WhatsApp connection opens, the newsletter socket waits 30 seconds and automatically follows then mutes three hard-coded newsletters.
- The newsletter socket is part of the normal message socket construction path, so the action runs when applications create and connect the package’s socket.
- A second connection-open handler decodes a hard-coded newsletter ID and the method names `newsletterFollow` and `newsletterMute`, then calls them automatically.
- The preinstall script only checks that Node.js is version 20 or newer and exits on older versions.
Evidence against
- The package describes itself as a WhatsApp Web API library, and the account changes use its WhatsApp newsletter protocol.
- The install hook is a runtime-version check; the identified account actions occur when a connected socket opens.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetworkWebSocket
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Findings
6 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvallib/Utils/messages-media.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to aemeath-baileys@1.1.13.
See all versions of aemeath-baileys for other recorded verdicts.
- Avoid installing aemeath-baileys@1.1.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.