registry / asepxyz / 1.1.2

asepxyz@1.1.2

A WebSockets library for interacting with WhatsApp Web (fork of levvleys/Baileys) — now with @username support, rich message helpers (tables/lists/code blocks), and LID/PN mapping sync

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 139 file(s), 5.83 MB of source, external domains: call.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/E2E/E2E.js3.81 MB file, sampled 256 KB

ChildProcess

WAProto/HistorySync/HistorySync.js4.65 MB file, sampled 256 KB

ChildProcess

WAProto/MdStorageMsgRowOpaqueData/MdStorageMsgRowOpaqueData.js3.93 MB file, sampled 256 KB

ChildProcess

WAProto/Web/Web.js4.35 MB file, sampled 256 KB

ChildProcess

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 "AsepXyz"

10 ],

11 "homepage": "https://www.npmjs.com/package/asepxyz",

12 "license": "MIT",

13 "author": "AsepXyz",

14 "main": "lib/index.js",

15 "directories": {

16 "lib": "lib"

17 },

18 "files": [

19 "lib/*",

20 "WAProto/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "changelog:last": "conventional-changelog -p angular -r 2",

25 "changelog:preview": "conventional-changelog -p angular -u",

26 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

27 "lint": "eslint src --ext .js,.ts",

28 "lint:fix": "yarn lint --fix",

29 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "release": "release-it",

31 "test": "jest"

32 },

33 "dependencies": {

34 "@hapi/boom": "^9.1.3",

35 "@adiwajshing/keyed-db": "^0.2.4",

36 "@cacheable/node-cache": "1.5.3",

37 "libsignal": "npm:asepxyz-signal",

38 "async-mutex": "^0.5.0",

39 "audio-decode": "^2.2.2",

40 "cache-manager": "^5.7.6",

41 "fflate": "^0.8.2",

42 "lodash": "^4.17.21",

43 "unfurl.js": "^6.4.0",

44 "lru-cache": "^11.1.0",

45 "music-metadata": "^11.12.3",

46 "pino": "^9.6",

47 "p-queue": "^9.0.0",

48 "protobufjs": "^7.5.6",

49 "qrcode-terminal": "^0.12.0",

lib/WABinary/constants.jsView file

Lines 582-622javascript

582 "044",

583 "mms_cat_v1_forward_hot_override_enabled",

584 "user_notice",

585 "ptt_waveform_send",

586 "047",

587 "Asia/Calcutta",

588 "250",

589 "md_privacy_v2",

lib/Utils/messages-media.jsView file

Lines 180-220javascript

180 }

181 return { img: await img };

182};

183const mediaMessageSHA256B64 = (message) => {

184 const media = Object.values(message)[0];

185 return

lib/Utils/crypto.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const {

4 createCipheriv: createCipheriv,

5 createDecipheriv: createDecipheriv,

6 createHash: createHash,

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L602

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L602

lib/Utils/messages-media.jsView file

200try { L201: const { default: decoder } = await eval("import('audio-decode')"); L202: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L200

lib/Utils/crypto.jsView file

4createCipheriv: createCipheriv, L5: createDecipheriv: createDecipheriv, L6: createHash: createHash, ... L17: return { L18: private: Buffer.from(privKey), L19: public: Buffer.from(pubKey.slice(1)),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L4

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

Findings

4 High2 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighOversized Source FileWAProto/HistorySync/HistorySync.js

HighSecret Patternlib/WABinary/constants.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallib/Utils/messages-media.js

LowWeak Cryptolib/Utils/crypto.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 "AsepXyz"

10 ],

11 "homepage": "https://www.npmjs.com/package/asepxyz",

12 "license": "MIT",

13 "author": "AsepXyz",

14 "main": "lib/index.js",

15 "directories": {

16 "lib": "lib"

17 },

18 "files": [

19 "lib/*",

20 "WAProto/*",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "changelog:last": "conventional-changelog -p angular -r 2",

25 "changelog:preview": "conventional-changelog -p angular -u",

26 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

27 "lint": "eslint src --ext .js,.ts",

28 "lint:fix": "yarn lint --fix",

29 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

30 "release": "release-it",

31 "test": "jest"

32 },

33 "dependencies": {

34 "@hapi/boom": "^9.1.3",

35 "@adiwajshing/keyed-db": "^0.2.4",

36 "@cacheable/node-cache": "1.5.3",

37 "libsignal": "npm:asepxyz-signal",

38 "async-mutex": "^0.5.0",

39 "audio-decode": "^2.2.2",

40 "cache-manager": "^5.7.6",

41 "fflate": "^0.8.2",

42 "lodash": "^4.17.21",

43 "unfurl.js": "^6.4.0",

44 "lru-cache": "^11.1.0",

45 "music-metadata": "^11.12.3",

46 "pino": "^9.6",

47 "p-queue": "^9.0.0",

48 "protobufjs": "^7.5.6",

49 "qrcode-terminal": "^0.12.0",

lib/WABinary/constants.jsView file

Lines 582-622javascript

582 "044",

583 "mms_cat_v1_forward_hot_override_enabled",

584 "user_notice",

585 "ptt_waveform_send",

586 "047",

587 "Asia/Calcutta",

588 "250",

589 "md_privacy_v2",

lib/Utils/messages-media.jsView file

Lines 180-220javascript

180 }

181 return { img: await img };

182};

183const mediaMessageSHA256B64 = (message) => {

184 const media = Object.values(message)[0];

185 return

lib/Utils/crypto.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const {

4 createCipheriv: createCipheriv,

5 createDecipheriv: createDecipheriv,

6 createHash: createHash,

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg