alipclutch-baileys@8.6.87
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe flagged media utility contains a concrete shell-injection risk when processing a crafted video path, warranting a warning. The preinstall script is a Node.js version check, not an observed malicious install action.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller requests a video thumbnail for a file path containing shell syntax.
Impact
Shell metacharacters in the path could execute commands with the package process's privileges.
Mechanism
The utility inserts the path directly into a command string and invokes child_process.exec.
AI rationale
The flagged media utility contains a concrete shell-injection risk when processing a crafted video path, warranting a warning. The preinstall script is a Node.js version check, not an observed malicious install action.
Evidence
lib/Utils/messages-media.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Video thumbnail generation interpolates a file path into a shell command passed to exec without shell escaping.
- The command runs when the thumbnail function processes video media.
- The preinstall hook only runs a Node.js version check.
Evidence against
- No endpoint or credential forwarding behavior was established in the inspected flagged code.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js8.08 MB file, sampled 256 KB
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/messages-media.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = alipclutch-baileys@8.6.90
matchedIdentity = npm:YWxpcGNsdXRjaC1iYWlsZXlz:8.6.90
similarity = 0.938
summary = stored previous version shares package body but lacks this dangerous source file
Findings
2 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighPrevious Version Dangerous Deltalib/Utils/messages-media.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumAi Review Evidencelib/Utils/messages-media.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to alipclutch-baileys@8.6.87.
See all versions of alipclutch-baileys for other recorded verdicts.
- Review the evidence and your use of alipclutch-baileys@8.6.87 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.