felicia-baileys
Modded Baileys V7 with interactive message, album, messageBuilder, newsletter, and VoIP support
This report shows the evidence for felicia-baileys@1.0.1, the only known version.
AI Security Review
scanned 1h ago · by lpm-firewall-aiThe package performs unsolicited WhatsApp account actions toward targets supplied by the publisher: it automatically follows listed newsletter channels and enables their admin notifications when a connection opens. This is malicious account-action behavior; the install-time script itself only checks the Node.js version.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A WhatsApp connection opens after the application creates its normal messaging socket.
Impact
Uses the user’s WhatsApp account to join channels selected by the publisher without the user requesting those actions.
Mechanism
The package fetches a channel list from the publisher’s GitHub repository, then issues follow and notification-setting requests for each listed newsletter ID.
Attack narrative
When a WhatsApp connection opens, the package waits 30 seconds, downloads a newsletter ID list from the publisher’s GitHub repository, follows each listed channel, and enables admin notifications. Normal messaging socket setup creates this newsletter socket, so the account actions can occur without an explicit request to join those channels.
AI rationale
The package performs unsolicited WhatsApp account actions toward targets supplied by the publisher: it automatically follows listed newsletter channels and enables their admin notifications when a connection opens. This is malicious account-action behavior; the install-time script itself only checks the Node.js version.
Evidence
src/Socket/newsletter.jssrc/Socket/messages-send.js
Network endpoints2
raw.githubusercontent.com/noxXza/data/refs/heads/main/noxleys.jsonWhatsApp newsletter service
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- On WhatsApp connection open, the newsletter socket schedules automatic channel-list processing.
- The package fetches channel IDs from https://raw.githubusercontent.com/noxXza/data/refs/heads/main/noxleys.json.
- For each listed newsletter ID, it sends a follow request and enables admin notifications.
- makeMessagesSocket constructs the newsletter socket as part of normal messaging socket setup.
Evidence against
- The preinstall script only checks the Node.js version.
- The package describes itself as a WhatsApp bot library with newsletter support.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
WAProto/index.js5.51 MB file, sampled 256 KB
Source & flagged code
11 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/Voip/worker-bootstrap.jsView file
336const code = fs.readFileSync(url, "utf8");
L337: eval(code);
L338: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/Voip/worker-bootstrap.jsView on unpkg · L336src/Utils/auth-store.jsView file
17try {
L18: const mod = await import(name);
L19: return mod.default ?? mod;
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/Utils/auth-store.jsView on unpkg · L17src/Voip/wasm-engine.jsView file
7import { fileURLToPath } from 'node:url';
L8: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L9: const CALL_WASM_AB_PROPS_JSON = process.env.CALL_WASM_AB_PROPS_JSON ?? "";
L10: const PTHREAD_POOL_SIZE = 20;
...
L15: try {
L16: const parsed = JSON.parse(raw);
L17: if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
...
L41: };
L42: const filterWorkerStderr = (chunk) => {
L43: const line = chunk.toString().trim();
L44: if (line && !line.startsWith("voip:") && !line.startsWith("still waiting")) {
L45: process.stderr.write(chunk);
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
src/Voip/wasm-engine.jsView on unpkg · L7src/Utils/validate-connection.jsView file
183pull: false,
L184: devicePairingData: {
L185: buildHash: appVersionBuf,
...
L210: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content);
L211: let hmacPrefix = Buffer.from([]);
L212: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) {
...
L234: ]);
L235: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg);
L236: const identity = createSignalIdentity(lid, accountSignatureKey);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/Utils/validate-connection.jsView on unpkg · L183src/assets/wasm/whatsapp.wasmView file
•path = src/assets/wasm/whatsapp.wasm
kind = wasm_module
sizeBytes = 9819554
magicHex = [redacted]
Medium
WAProto/index.jsView file
•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkg•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 5773593
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgsrc/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = @nerxa/socketon@1.21.0
matchedPath = src/Utils/messages-media.js
matchedIdentity = npm:QG5lcnhhL3NvY2tldG9u:1.21.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/Utils/messages-media.jsView on unpkgsrc/Voip/audio-feeder.jsView file
•matchType = normalized_sha256
matchedPackage = @nerxa/socketon@1.21.0
matchedPath = src/Voip/audio-feeder.js
matchedIdentity = npm:QG5lcnhhL3NvY2tldG9u:1.21.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/Voip/audio-feeder.jsView on unpkgsrc/Voip/video-feeder.jsView file
•matchType = normalized_sha256
matchedPackage = @nerxa/socketon@1.21.0
matchedPath = src/Voip/video-feeder.js
matchedIdentity = npm:QG5lcnhhL3NvY2tldG9u:1.21.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/Voip/video-feeder.jsView on unpkgFindings
5 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritysrc/Utils/messages-media.js
HighKnown Malware Source Similaritysrc/Voip/audio-feeder.js
HighKnown Malware Source Similaritysrc/Voip/video-feeder.js
MediumDynamic Requiresrc/Utils/auth-store.js
MediumUnsafe Vm Contextsrc/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulesrc/assets/wasm/whatsapp.wasm
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/Voip/worker-bootstrap.js
LowWeak Cryptosrc/Utils/validate-connection.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to felicia-baileys@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing felicia-baileys@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.