registry / jagproject / 28.0.0

jagproject@28.0.0

WhatsApp Web API Library JagProject v28 dengan inti AlipClutch Baileys dan newsletter follow JagProject

AI Security Review

scanned 9d ago · by lpm-firewall-ai

A runtime video-thumbnail API builds an unquoted ffmpeg shell command from its file argument. This is a command-injection vulnerability, not install-time malware.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A consumer calls generateThumbnail with a video file path containing shell metacharacters.

Impact

Arbitrary command execution in the consuming application's account.

Mechanism

Unquoted path interpolation into child_process.exec

Rationale

The package does not show malicious install behavior, but it ships a concrete, externally reachable command-injection primitive. This warrants a warning for a critical vulnerability.

Evidence

package.jsonengine-requirements.jslib/Utils/messages-media.jslib/Utils/index.jslib/Utils/messages-media.d.ts

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

lib/Utils/messages-media.js interpolates file path into shell command passed to child_process.exec.

jagproject@28.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code