registry / amiudmodz / 6.0.7

amiudmodz@6.0.7

WhatsApp Baileys mod Powered by UDMODZ

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 121 file(s), 1.88 MB of source, external domains: call.whatsapp.com, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js5.01 MB file, sampled 256 KB

ChildProcess

Source & flagged code

8 flagged

package.jsonView file

Lines 11-51json

11 "whatsapp-web"

12 ],

13 "main": "lib/index.js",

14 "types": "lib/index.d.ts",

15 "files": [

16 "lib/**/*",

17 "WAProto/**/*",

18 "engine-requirements.js"

19 ],

20 "scripts": {

21 "build:all": "npm run build && npm run build:docs",

22 "build:docs": "typedoc",

23 "build": "tsc -P tsconfig.build.json && tsc-esm-fix --tsconfig=tsconfig.build.json --ext=.js",

24 "changelog:last": "conventional-changelog -p angular -r 2",

25 "changelog:preview": "conventional-changelog -p angular -u",

26 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

27 "lint": "tsc && eslint src --ext .js,.ts",

28 "lint:fix": "eslint src --fix --ext .js,.ts",

29 "prepack": "npm run build",

30 "prepare": "npm run build",

31 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "release": "release-it",

33 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'"

34 },

35 "dependencies": {

36 "@cacheable/node-cache": "^1.4.0",

37 "@hapi/boom": "^9.1.3",

38 "async-mutex": "^0.5.0",

39 "audio-decode": "^2.1.3",

40 "fflate": "^0.8.3",

41 "libsignal": "^6.0.0",

42 "lru-cache": "^11.1.0",

43 "music-metadata": "^11.12.3",

44 "p-queue": "^9.0.0",

45 "pino": "^9.6.0",

46 "protobufjs": "^7.5.6",

47 "whatsapp-rust-bridge": "0.5.4",

48 "ws": "^8.21.0"

49 },

50 "devDependencies": {

51 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

lib/Utils/messages-media.jsView file

Lines 5-45javascript

5import { createReadStream, createWriteStream, promises as fs, WriteStream } from 'fs';

6import { tmpdir } from 'os';

7import { join } from 'path';

8import { Readable, Transform } from 'stream';

9import { URL } from 'url';

lib/Utils/validate-connection.jsView file

Lines 88-128javascript

88 supportBizHostedMsg: true,

89 supportRecentSyncChunkMessageCountTuning: true,

90 supportHostedGroupMsg: true,

91 supportFbidBotChatHistory: true,

92 supportAddOnHistorySyncMigration: undefined,

93 supportMessageAssociation

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 305 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5256183 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-36typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: number;

5 DICTIONARY_2: number;

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/messages-media.jsView file

25const [sharp, image, jimp] = await Promise.all([ L26: import(sharpModule).catch(() => { }), L27: import(napiRsImageModule).catch(() => { }),

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Utils/messages-media.jsView on unpkg · L25

lib/Utils/validate-connection.jsView file

108pull: false, L109: devicePairingData: { L110: buildHash: appVersionBuf, ... L135: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L136: let hmacPrefix = Buffer.from([]); L137: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L159: ]); L160: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L161: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L108

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 305 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5256183 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

Findings

5 High4 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighOversized Source FileWAProto/index.js

HighSecret Patternlib/WABinary/constants.js

HighSecret Patternlib/WABinary/constants.d.ts

MediumDynamic Requirelib/Utils/messages-media.js

MediumNetwork

MediumShips Build HelperWAProto/GenerateStatics.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 11-51json

11 "whatsapp-web"

12 ],

13 "main": "lib/index.js",

14 "types": "lib/index.d.ts",

15 "files": [

16 "lib/**/*",

17 "WAProto/**/*",

18 "engine-requirements.js"

19 ],

20 "scripts": {

21 "build:all": "npm run build && npm run build:docs",

22 "build:docs": "typedoc",

23 "build": "tsc -P tsconfig.build.json && tsc-esm-fix --tsconfig=tsconfig.build.json --ext=.js",

24 "changelog:last": "conventional-changelog -p angular -r 2",

25 "changelog:preview": "conventional-changelog -p angular -u",

26 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

27 "lint": "tsc && eslint src --ext .js,.ts",

28 "lint:fix": "eslint src --fix --ext .js,.ts",

29 "prepack": "npm run build",

30 "prepare": "npm run build",

31 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "release": "release-it",

33 "test": "node --experimental-vm-modules ./node_modules/.bin/jest --testMatch '**/*.test.ts'"

34 },

35 "dependencies": {

36 "@cacheable/node-cache": "^1.4.0",

37 "@hapi/boom": "^9.1.3",

38 "async-mutex": "^0.5.0",

39 "audio-decode": "^2.1.3",

40 "fflate": "^0.8.3",

41 "libsignal": "^6.0.0",

42 "lru-cache": "^11.1.0",

43 "music-metadata": "^11.12.3",

44 "p-queue": "^9.0.0",

45 "pino": "^9.6.0",

46 "protobufjs": "^7.5.6",

47 "whatsapp-rust-bridge": "0.5.4",

48 "ws": "^8.21.0"

49 },

50 "devDependencies": {

51 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586 '250',

587 'md_privacy_v2',

lib/Utils/messages-media.jsView file

Lines 5-45javascript

5import { createReadStream, createWriteStream, promises as fs, WriteStream } from 'fs';

6import { tmpdir } from 'os';

7import { join } from 'path';

8import { Readable, Transform } from 'stream';

9import { URL } from 'url';

lib/Utils/validate-connection.jsView file

Lines 88-128javascript

88 supportBizHostedMsg: true,

89 supportRecentSyncChunkMessageCountTuning: true,

90 supportHostedGroupMsg: true,

91 supportFbidBotChatHistory: true,

92 supportAddOnHistorySyncMigration: undefined,

93 supportMessageAssociation

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 305 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5256183 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/index.jsView on unpkg

lib/WABinary/constants.d.tsView file

Lines 1-36typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1: number;

5 DICTIONARY_2: number;