alipclutch-baileys@8.6.85
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 12d ago · by lpm-firewall-aiStatic inspection found a command injection risk in user-invoked video thumbnail generation. The preinstall hook only checks the Node.js version, so the evidence supports a warning for remote code execution risk rather than a malicious package verdict.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller invokes video thumbnail generation with a crafted file path.
Impact
Potential command execution with the permissions of the application process.
Mechanism
The utility interpolates the input and output paths into a command string and executes it through child_process.exec.
AI rationale
Static inspection found a command injection risk in user-invoked video thumbnail generation. The preinstall hook only checks the Node.js version, so the evidence supports a warning for remote code execution risk rather than a malicious package verdict.
Evidence
lib/Utils/messages-media.jslib/index.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- lib/Utils/messages-media.js builds an ffmpeg shell command by interpolating media and output paths, then executes it.
- The video thumbnail function passes its file argument to that command; the utility is re-exported by lib/index.js.
Evidence against
- package.json’s preinstall hook runs a Node version check; it does not establish a malicious install-time action.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js8.08 MB file, sampled 256 KB
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/messages-media.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = alipclutch-baileys@8.6.90
matchedIdentity = npm:YWxpcGNsdXRjaC1iYWlsZXlz:8.6.90
similarity = 0.928
summary = stored previous version shares package body but lacks this dangerous source file
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltalib/Utils/messages-media.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumAi Review Evidencelib/Utils/messages-media.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to alipclutch-baileys@8.6.85.
See all versions of alipclutch-baileys for other recorded verdicts.
- Review the evidence and your use of alipclutch-baileys@8.6.85 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.