itssofc
Aemeath Baileys WhatsApp Web API Library
This report shows the evidence for itssofc@1.2.13, the only known version.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe package automatically follows and mutes newsletters chosen by a remotely maintained list whenever a WhatsApp connection opens. These account actions use the user's connected account without a request, matching the malicious account-action rule.
Decision evidence
public snapshot- The newsletter socket fetches its channel IDs from a publisher-controlled JSON file at raw.githubusercontent.com.
- It uses the fetched IDs to follow and mute newsletters without a user request.
- This action starts 30 seconds after the WhatsApp connection opens.
- The standard socket construction path includes the newsletter socket.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages-media.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
lib/Utils/messages-media.jsView on unpkg · L369A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
WAProto/index.jsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages.jsView on unpkgFindings
Affected versions and remediation
This report applies to itssofc@1.2.13.
The versions list below shows the verdict for each recorded version.
- Avoid installing itssofc@1.2.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.