dzyclutch-baileys
This report shows the evidence for dzyclutch-baileys@1.1.23. 12 of 12 known versions are blocked or flagged. See all versions.
This package appears in our research on the malicious Baileys forks, with how it works, the full package list and what to do if you installed it.
OpenSSF/OSV Malicious Advisory
imported 15d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17620 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
Source inspection establishes conditional credential forwarding to unrestricted custom hosts and unsafe shell interpolation, supporting a warning. The inspected behavior does not establish malicious intent or a block-eligible attack chain.
Independent scan evidence
public snapshot- The socket obtains a media authorization token from the WhatsApp media connection response.
- Media uploads prepend caller-configured hosts without destination validation, place the service token in the URL, and send an HTTP POST.
- The active socket passes its configuration into the uploader; custom upload hosts default to an empty list.
- Video thumbnail generation interpolates the supplied file path into an unquoted shell command executed through child_process.exec.
- The preinstall script only enforces Node.js 20 or newer; no runtime self-dependency is declared.
- No hidden recipient, automatic credential export, or concrete malware intent was established.
Source & flagged code
4 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgA bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to dzyclutch-baileys@1.1.23.
The versions list below shows the verdict for each recorded version.
- Avoid installing dzyclutch-baileys@1.1.23. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.