registry / diezyxhao-baileys / 1.4.0
diezyxhao-baileys@1.4.0
DIEZYXHAO BAILEYS - Advanced WhatsApp Web API Library with Latest Protocol Support
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe package's prepare and prepack hooks are empty, and the reviewed A2UI operations require an explicit caller invocation with supplied inputs. Its optional HTTP image retrieval and WhatsApp message relay align with the package's stated API purpose; no malicious behavior was found.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Importing the package prints a one-time banner; image retrieval and message sending occur only when the application invokes the respective helpers.
Impact
No unsolicited credential access, install-time contact, or automatic account action was identified.
Mechanism
A helper may GET a caller-provided HTTP(S) image URL, read a caller-provided local image path, then relay a constructed message through the caller's WhatsApp socket to the supplied JID.
AI rationale
The package's prepare and prepack hooks are empty, and the reviewed A2UI operations require an explicit caller invocation with supplied inputs. Its optional HTTP image retrieval and WhatsApp message relay align with the package's stated API purpose; no malicious behavior was found.
Network endpoints2
Caller-provided HTTP(S) image URL (axios GET)a2ui.org/specification/v0_9/catalogs/basic/catalog.json (catalog URL constant; no request identified)
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest's prepare and prepack scripts are empty, so they perform no install-time action.
- The A2UI module is re-exported as a library feature; its send functions require a caller-provided socket and target.
- The optional image download uses a URL supplied to the send helper, and the resulting message is relayed through the caller's socket.
- The package entry point prints a one-time creator banner at import; no harmful behavior was identified in that side effect.
Evidence against
- The A2UI helpers can make HTTP(S) requests for image inputs and read a caller-supplied local image path when invoked.
- The send helpers transmit messages to the target JID supplied by the caller, consistent with the package's WhatsApp API purpose.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flaggedWAProto/index.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkg•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 5645056
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/a2ui.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = diezyxhao-baileys@1.3.2
matchedIdentity = npm:ZGllenl4aGFvLWJhaWxleXM:1.3.2
similarity = 0.845
summary = stored previous version shares package body but lacks this dangerous source file
High
Findings
2 High4 Medium6 Low
HighSemantic Analysis LimitedWAProto/index.js
HighPrevious Version Dangerous Deltalib/Utils/a2ui.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to diezyxhao-baileys@1.4.0.
See all versions of diezyxhao-baileys for other recorded verdicts.
- Review the evidence and your use of diezyxhao-baileys@1.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.