bungoma@1.1.1
AI Security Review
scanned 13d ago · by lpm-firewall-aiInspected source supports a WhatsApp API library with no declared lifecycle scripts. The scanner’s secret and eval signals correspond to protocol constants and an optional audio decoder import; no malicious behavior was confirmed.
Static reason
One or more suspicious static signals were detected.
Trigger
No malicious trigger was found; media helpers run when called by the library.
Impact
No confirmed unauthorized access, data transfer, persistence, or destructive effect was established.
Mechanism
The inspected eval expression imports an audio decoder, while the shell helper invokes ffmpeg to create a media thumbnail.
AI rationale
Inspected source supports a WhatsApp API library with no declared lifecycle scripts. The scanner’s secret and eval signals correspond to protocol constants and an optional audio decoder import; no malicious behavior was confirmed.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies bungoma as a WhatsApp Web API library and declares lib/index.js as its entry point.
- package.json ends after its dependency list without declaring lifecycle scripts.
- lib/WABinary/constants.js contains protocol token strings and WhatsApp OTP URL constants, consistent with protocol data rather than a credential secret.
- lib/Utils/rich-messages.js builds WhatsApp message context metadata from quoted-message fields.
- lib/Utils/messages-media.js uses eval only to dynamically import the audio-decode module for waveform processing.
- Video thumbnail generation invokes ffmpeg with a file path and generated temporary image filename.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcelib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603lib/Utils/messages-media.jsView file
256try {
L257: const { default: decoder } = await eval("import('audio-decode')");
L258: let audioData;
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/Utils/messages-media.jsView on unpkg · L256Findings
3 High4 Medium5 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/rich-messages.js#virtual:normalized:round1
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowEvallib/Utils/messages-media.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to bungoma@1.1.1.
See all versions of bungoma for other recorded verdicts.
- Review the evidence and your use of bungoma@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.