registry / asepxyz / 1.0.1

asepxyz@1.0.1

A WebSockets library for interacting with WhatsApp Web (fork of levvleys/Baileys)

Static Scan Results

scanned 11h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

GitDependency

scanned 126 file(s), 5.77 MB of source, external domains: call.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/E2E/E2E.js3.81 MB file, sampled 256 KB

ChildProcess

WAProto/HistorySync/HistorySync.js4.65 MB file, sampled 256 KB

ChildProcess

WAProto/MdStorageMsgRowOpaqueData/MdStorageMsgRowOpaqueData.js3.93 MB file, sampled 256 KB

ChildProcess

WAProto/Web/Web.js4.35 MB file, sampled 256 KB

ChildProcess

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 "AsepXyz"

10 ],

11 "homepage": "https://www.npmjs.com/package/asepxyz",

12 "license": "MIT",

13 "author": "AsepXyz",

14 "main": "lib/index.js",

15 "directories": {

16 "lib": "lib"

17 },

18 "files": [

19 "lib/*",

20 "WAProto/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "changelog:last": "conventional-changelog -p angular -r 2",

25 "changelog:preview": "conventional-changelog -p angular -u",

26 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

27 "lint": "eslint src --ext .js,.ts",

28 "lint:fix": "yarn lint --fix",

29 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "release": "release-it",

31 "test": "jest"

32 },

33 "dependencies": {

34 "@hapi/boom": "^9.1.3",

35 "@adiwajshing/keyed-db": "^0.2.4",

36 "@cacheable/node-cache": "1.5.3",

37 "libsignal": "github:ramadanny/libsignal-node",

38 "async-mutex": "^0.5.0",

39 "audio-decode": "^2.2.2",

40 "cache-manager": "^5.7.6",

41 "fflate": "^0.8.2",

42 "lodash": "^4.17.21",

43 "unfurl.js": "^6.4.0",

44 "lru-cache": "^11.1.0",

45 "music-metadata": "^7.12.3",

46 "pino": "^9.6",

47 "p-queue": "^9.0.0",

48 "protobufjs": "^7.2.4",

49 "qrcode-terminal": "^0.12.0",

lib/WABinary/constants.jsView file

Lines 582-622javascript

582 "044",

583 "mms_cat_v1_forward_hot_override_enabled",

584 "user_notice",

585 "ptt_waveform_send",

586 "047",

587 "Asia/Calcutta",

588 "250",

589 "md_privacy_v2",

lib/Utils/messages-media.jsView file

Lines 180-220javascript

180 }

181 return { img: await img };

182};

183const mediaMessageSHA256B64 = (message) => {

184 const media = Object.values(message)[0];

185 return

lib/Utils/crypto.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const {

4 createCipheriv: createCipheriv,

5 createDecipheriv: createDecipheriv,

6 createHash: createHash,

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L602

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L602

lib/Utils/messages-media.jsView file

200try { L201: const { default: decoder } = await eval("import('audio-decode')"); L202: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L200

lib/Utils/crypto.jsView file

4createCipheriv: createCipheriv, L5: createDecipheriv: createDecipheriv, L6: createHash: createHash, ... L17: return { L18: private: Buffer.from(privKey), L19: public: Buffer.from(pubKey.slice(1)),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L4

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

Findings

4 High3 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighOversized Source FileWAProto/HistorySync/HistorySync.js

HighSecret Patternlib/WABinary/constants.js

MediumNetwork

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowScripts Present

LowEvallib/Utils/messages-media.js

LowWeak Cryptolib/Utils/crypto.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 "AsepXyz"

10 ],

11 "homepage": "https://www.npmjs.com/package/asepxyz",

12 "license": "MIT",

13 "author": "AsepXyz",

14 "main": "lib/index.js",

15 "directories": {

16 "lib": "lib"

17 },

18 "files": [

19 "lib/*",

20 "WAProto/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "changelog:last": "conventional-changelog -p angular -r 2",

25 "changelog:preview": "conventional-changelog -p angular -u",

26 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

27 "lint": "eslint src --ext .js,.ts",

28 "lint:fix": "yarn lint --fix",

29 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "release": "release-it",

31 "test": "jest"

32 },

33 "dependencies": {

34 "@hapi/boom": "^9.1.3",

35 "@adiwajshing/keyed-db": "^0.2.4",

36 "@cacheable/node-cache": "1.5.3",

37 "libsignal": "github:ramadanny/libsignal-node",

38 "async-mutex": "^0.5.0",

39 "audio-decode": "^2.2.2",

40 "cache-manager": "^5.7.6",

41 "fflate": "^0.8.2",

42 "lodash": "^4.17.21",

43 "unfurl.js": "^6.4.0",

44 "lru-cache": "^11.1.0",

45 "music-metadata": "^7.12.3",

46 "pino": "^9.6",

47 "p-queue": "^9.0.0",

48 "protobufjs": "^7.2.4",

49 "qrcode-terminal": "^0.12.0",

lib/WABinary/constants.jsView file

Lines 582-622javascript

582 "044",

583 "mms_cat_v1_forward_hot_override_enabled",

584 "user_notice",

585 "ptt_waveform_send",

586 "047",

587 "Asia/Calcutta",

588 "250",

589 "md_privacy_v2",

lib/Utils/messages-media.jsView file

Lines 180-220javascript

180 }

181 return { img: await img };

182};

183const mediaMessageSHA256B64 = (message) => {

184 const media = Object.values(message)[0];

185 return

lib/Utils/crypto.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const {

4 createCipheriv: createCipheriv,

5 createDecipheriv: createDecipheriv,

6 createHash: createHash,

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg