dzyclutch-baileys@1.1.16: Malicious npm security report (Block)

Loading npm security reports…

dzyclutch-baileys@1.1.16: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

package.jsonView file

Lines 16-56json

16 "main": "lib/index.js",

17 "types": "lib/index.d.ts",

18 "files": [

19 "lib/",

20 "WAProto/",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "build:all": "tsc && typedoc",

25 "build:docs": "typedoc",

26 "build:tsc": "tsc",

27 "changelog:last": "conventional-changelog -p angular -r 2",

28 "changelog:preview": "conventional-changelog -p angular -u",

29 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

30 "example": "node --inspect -r ts-node/register Example/example.ts",

31 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

32 "lint": "node -e \"const { execSync } = require('child_process'); execSync('find lib/ -name \\\"*.js\\\" | xargs -I{} node --check {}'); console.log('LINT_OK');\"",

33 "lint:fix": "eslint lib --fix --ext .js",

34 "prepack": "echo 'dzyclutch WhatsApp Library'",

35 "prepare": "echo 'dzyclutch WhatsApp Library'",

36 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 "release": "release-it",

38 "test": "jest"

39 },

40 "dependencies": {

41 "@adiwajshing/keyed-db": "^0.2.4",

42 "@cacheable/node-cache": "^1.4.0",

43 "@hapi/boom": "^9.1.3",

44 "async-mutex": "^0.5.0",

45 "axios": "^1.6.0",

46 "cache-manager": "^5.7.6",

47 "chalk": "^4.1.2",

48 "cheerio": "^1.0.0-rc.10",

49 "fflate": "^0.8.2",

50 "gradient-string": "^2.0.2",

51 "jimp": "^0.22.12",

52 "libphonenumber-js": "^1.10.20",

53 "libsignal": "npm:dzyclutch-libsignal-node",

54 "lodash": "^4.17.21",

55 "lru-cache": "^11.1.0",

56 "music-metadata": "^7.12.3",

lib/WABinary/constants.jsView file

Lines 583-623javascript

583 '044',

584 'mms_cat_v1_forward_hot_override_enabled',

585 'user_notice',

586 'ptt_waveform_send',

587 '047',

588 'Asia/Calcutta',

589

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = parxleys@1.0.0 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:cGFyeGxleXM:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1a1a3c1e9edb7579 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = parxleys@1.0.0 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:cGFyeGxleXM:1.0.0 similarity = 1.000 shingleOverlap = 66 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

369try { L370: const { default: decoder } = await eval('import(\'audio-decode\')'); L371: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L369

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5329994 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = parxleys@1.0.0 matchedPath = lib/Utils/messages.js matchedIdentity = npm:cGFyeGxleXM:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

369try { L370: const { default: decoder } = await eval('import(\'audio-decode\')'); L371: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L369

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5329994 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 16-56json

16 "main": "lib/index.js",

17 "types": "lib/index.d.ts",

18 "files": [

19 "lib/",

20 "WAProto/",

21 "engine-requirements.js"

22 ],

23 "scripts": {

24 "build:all": "tsc && typedoc",

25 "build:docs": "typedoc",

26 "build:tsc": "tsc",

27 "changelog:last": "conventional-changelog -p angular -r 2",

28 "changelog:preview": "conventional-changelog -p angular -u",

29 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

30 "example": "node --inspect -r ts-node/register Example/example.ts",

31 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

32 "lint": "node -e \"const { execSync } = require('child_process'); execSync('find lib/ -name \\\"*.js\\\" | xargs -I{} node --check {}'); console.log('LINT_OK');\"",

33 "lint:fix": "eslint lib --fix --ext .js",

34 "prepack": "echo 'dzyclutch WhatsApp Library'",

35 "prepare": "echo 'dzyclutch WhatsApp Library'",

36 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L36

37 "release": "release-it",

38 "test": "jest"

39 },

40 "dependencies": {

41 "@adiwajshing/keyed-db": "^0.2.4",

42 "@cacheable/node-cache": "^1.4.0",

43 "@hapi/boom": "^9.1.3",

44 "async-mutex": "^0.5.0",

45 "axios": "^1.6.0",

46 "cache-manager": "^5.7.6",

47 "chalk": "^4.1.2",

48 "cheerio": "^1.0.0-rc.10",

49 "fflate": "^0.8.2",

50 "gradient-string": "^2.0.2",

51 "jimp": "^0.22.12",

52 "libphonenumber-js": "^1.10.20",

53 "libsignal": "npm:dzyclutch-libsignal-node",

54 "lodash": "^4.17.21",

55 "lru-cache": "^11.1.0",

56 "music-metadata": "^7.12.3",

lib/WABinary/constants.jsView file

Lines 583-623javascript

583 '044',

584 'mms_cat_v1_forward_hot_override_enabled',

585 'user_notice',

586 'ptt_waveform_send',

587 '047',

588 'Asia/Calcutta',

589

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

369try { L370: const { default: decoder } = await eval('import(\'audio-decode\')'); L371: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L369

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5329994 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

dzyclutch-baileys@1.1.16

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code