registry / alipclutch-baileys / 8.6.88
alipclutch-baileys@8.6.88
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 12d ago · by lpm-firewall-aiStatic source inspection found a Node.js compatibility check in preinstall and package-aligned media handling. The scanner hints did not establish malicious behavior in the inspected files.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Package installation runs the preinstall hook; media functions run when called by the consuming application.
Impact
No attack impact was established from the inspected source.
Mechanism
The hook parses the Node.js major version and exits on versions below 20. Media upload hosts include configured hosts and hosts returned by the refreshed media connection.
AI rationale
Static source inspection found a Node.js compatibility check in preinstall and package-aligned media handling. The scanner hints did not establish malicious behavior in the inspected files.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json runs a preinstall script that checks the Node.js version and exits when it is below 20.
- The flagged version file contains only a WhatsApp version tuple.
- The media module’s custom upload hosts are combined with hosts returned by the media connection refresh; no independent credential theft path was established.
Evidence against
- Media upload and download behavior is consistent with WhatsApp media handling.
- The package has no confirmed malicious install-time mutation or credential exfiltration in the inspected paths.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
GitDependency
Oversized source lightweight scan
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Defaults/baileys-version.jsonView file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2
High
Findings
3 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limitedlib/Defaults/baileys-version.json
HighPrevious Version Dangerous Deltalib/Utils/messages-media.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to alipclutch-baileys@8.6.88.
See all versions of alipclutch-baileys for other recorded verdicts.
- Review the evidence and your use of alipclutch-baileys@8.6.88 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.