alipclutch-baileys@8.6.91
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 12d ago · by lpm-firewall-aiSource inspection confirms a command injection vulnerability reachable through the exported thumbnail helper, but does not establish automatic exploitation or malicious intent. The package's preinstall hook only checks the Node version.
Decision evidence
public snapshot- Video thumbnail generation interpolates media paths into a shell command and runs it with exec, creating a command-injection risk for crafted paths.
- The thumbnail function is exported, so package consumers can invoke the affected behavior.
- The preinstall hook only runs a Node version check; no install-time attack behavior was identified.
- The flagged protocol source begins with a protobuf runtime import and generated protocol definitions; the inspected excerpt shows no attack behavior.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to alipclutch-baileys@8.6.91.
See all versions of alipclutch-baileys for other recorded verdicts.
- Review the evidence and your use of alipclutch-baileys@8.6.91 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.