ishumdz-bail@1.0.15: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

ishumdz-bail@1.0.15: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Caller/worker-bootstrap.mjsView file

346const code = fs.readFileSync(url, "utf8"); L347: eval(code); L348: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Caller/worker-bootstrap.mjsView on unpkg · L346

lib/Caller/index.mjsView file

30const rel = "../index.js"; L31: return await import(rel); L32: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Caller/index.mjsView on unpkg · L30

lib/Caller/wasm-engine.mjsView file

17const __filename = fileURLToPath(import.meta.url); L18: const __dirname = path.dirname(__filename); L19: const CALL_WASM_AB_PROPS_JSON = process.env.CALL_WASM_AB_PROPS_JSON ?? ""; L20: const PTHREAD_POOL_SIZE = Math.max(1, Math.min(Number(process.env.PTHREAD_POOL_SIZE || 1), 4)); ... L25: try { L26: const parsed = JSON.parse(raw); L27: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) ... L51: }; L52: const filterWorkerStderr = (chunk) => { L53: const line = chunk.toString().trim(); L54: if (line && !line.startsWith("voip:") && !line.startsWith("still waiting")) { L55: process.stderr.write(chunk);

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/Caller/wasm-engine.mjsView on unpkg · L17

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 24-64json

24 "author": "Lovely",

25 "main": "lib/index.js",

26 "types": "lib/index.d.ts",

27 "files": [

28 "lib/**/*",

29 "WAProto/*.js",

30 "WAProto/*.d.ts",

31 "engine-requirements.js"

32 ],

33 "scripts": {

34 "build:all": "tsc && typedoc",

35 "build:docs": "typedoc",

36 "build:tsc": "tsc",

37 "changelog:last": "conventional-changelog -p angular -r 2",

38 "changelog:preview": "conventional-changelog -p angular -u",

39 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

40 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

41 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

42 "prepack": "",

43 "prepare": "",

44 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 "release": "release-it",

46 "test": "jest"

47 },

48 "dependencies": {

49 "@cacheable/node-cache": "^1.4.0",

50 "@hapi/boom": "^9.1.3",

51 "async-mutex": "^0.5.0",

52 "libsignal": "github:tenka-san/libsignal-node",

53 "lru-cache": "^11.1.0",

54 "music-metadata": "^11.12.3",

55 "p-queue": "^9.0.0",

56 "pino": "^9.6",

57 "protobufjs": "^7.5.6",

58 "whatsapp-rust-bridge": "0.5.4",

59 "ws": "^8.13.0",

60 "chalk": "^4.1.2",

61 "cache-manager": "^7.2.8"

62 },

63 "devDependencies": {

64 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Caller/worker-bootstrap.mjsView file

Lines 326-366javascript

326__modules["Promise"] = { exports: Promise };

327const bxFunc = function (id) { return id; };

328bxFunc.getURL = function

lib/Caller/index.mjsView file

Lines 10-50javascript

10 *

11 * @author ShellTear

12 */

13import { EventEmitter } from "node:events";

14import { randomBytes, createHmac } from "node:crypto";

15import { resolve }

lib/Caller/wasm-engine.mjsView file

Lines 1-37javascript

1var _a;

2/**

3 * WhatsApp VoIP WASM engine.

4 *

5 * Loads the WhatsApp Web VoIP WASM stack inside a Node.js `vm.Context`,

6 * spawns a 20-thread `worker_threads` pool to mirror the browser's pthread

7 * model, and exposes a callback-based JS bridge. Audio-only (no video).

8 *

9 * @author ShellTear

10

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg