itssofc@1.2.13
Aemeath Baileys WhatsApp Web API Library
AI Security Review
scanned 3h ago · by lpm-firewall-aiThe package automatically follows and mutes newsletters chosen by a remotely maintained list whenever a WhatsApp connection opens. These account actions use the user's connected account without a request, matching the malicious account-action rule.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
By default, 30 seconds after a WhatsApp connection opens.
Impact
The account is modified without the user's request; the remote publisher can choose the channels.
Mechanism
Fetches newsletter IDs from a remote JSON file, then follows and mutes each ID using the connected account.
Attack narrative
When the normal socket connects, the package fetches a newsletter list from raw.githubusercontent.com and, without user input, follows and mutes each listed channel through the user's WhatsApp account.
AI rationale
The package automatically follows and mutes newsletters chosen by a remotely maintained list whenever a WhatsApp connection opens. These account actions use the user's connected account without a request, matching the malicious account-action rule.
Evidence
lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/business.js
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The newsletter socket fetches its channel IDs from a publisher-controlled JSON file at raw.githubusercontent.com.
- It uses the fetched IDs to follow and mute newsletters without a user request.
- This action starts 30 seconds after the WhatsApp connection opens.
- The standard socket construction path includes the newsletter socket.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
WAProto/index.js5.08 MB file, sampled 256 KB
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Findings
6 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvallib/Utils/messages-media.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to itssofc@1.2.13.
See all versions of itssofc for other recorded verdicts.
- Avoid installing itssofc@1.2.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.