alipclutch-baileys@8.6.90
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package does not show a malicious installer chain, but its exported media-processing behavior contains a concrete command-injection risk. The unsafe shell invocation warrants a warning rather than publication blocking.
Decision evidence
public snapshot- The media thumbnail helper interpolates a path into an unquoted shell command.
- That helper runs the constructed command with child_process.exec, enabling command injection when a crafted media path reaches it.
- The preinstall hook only checks the running Node.js major version and exits on unsupported versions.
- No source evidence shows credential harvesting, covert exfiltration, or installer-side project mutation.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to alipclutch-baileys@8.6.90.
See all versions of alipclutch-baileys for other recorded verdicts.
- Review the evidence and your use of alipclutch-baileys@8.6.90 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.