cyberdark-baileys@2.1.9
Blacklord Bail - WhatsApp Web socket library based on Baileys, with branded pairing, rainbow console banner and auto-connect support
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe package automatically uses the user's WhatsApp account to join a publisher-selected group and follow a publisher-selected channel when a socket connects. The targets have defaults, so ordinary use triggers these unrequested account actions.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
The application creates the package's WhatsApp socket and the connection reaches open.
Impact
The user's WhatsApp account joins a publisher-selected group and follows a publisher-selected channel without an explicit request for either action.
Mechanism
Socket construction registers a connection handler that calls groupAcceptInvite and newsletterFollow using hard-coded targets by default; optional config or environment values can override them.
Attack narrative
When an application creates a WhatsApp socket, the package registers an open-connection handler. Once connected, that handler automatically joins the hard-coded WhatsApp group and follows the hard-coded channel, using configured overrides only when supplied. These are account actions toward targets chosen by the publisher, without explicit user consent.
AI rationale
The package automatically uses the user's WhatsApp account to join a publisher-selected group and follow a publisher-selected channel when a socket connects. The targets have defaults, so ordinary use triggers these unrequested account actions.
Evidence
lib/Astrocore/autoConnect.jslib/Socket/communities.jslib/Socket/index.js
Network endpoints2
chat.whatsapp.com/FYDghXAdZpL7ceOV7J7GxXwhatsapp.com/channel/0029VbDSKRu4tRrrxvFQbY0F
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- When the WhatsApp connection opens, the code automatically joins a group and follows a channel.
- The group invite and channel are hard-coded publisher-selected targets and are used as defaults.
- Creating the exported WhatsApp socket wires in this automatic behavior.
Evidence against
- The package is a WhatsApp Web socket library, so connecting to WhatsApp is within its stated purpose.
- The package manifest has no install, preinstall, or postinstall hook.
- Code comments describe the auto-connect behavior, but it runs by default without explicit user consent to join or follow those targets.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600lib/Utils/validate-connection.jsView file
114pull: false,
L115: devicePairingData: {
L116: buildHash: appVersionBuf,
...
L141: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content);
L142: let hmacPrefix = Buffer.from([]);
L143: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) {
...
L165: ]);
L166: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg);
L167: const identity = createSignalIdentity(lid, accountSignatureKey);
Findings
5 High5 Medium5 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to cyberdark-baileys@2.1.9.
See all versions of cyberdark-baileys for other recorded verdicts.
- Avoid installing cyberdark-baileys@2.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.