Loading npm security reports…

jagproject@28.2.0: Malicious npm security report (Block) | LPM Firewall

registry / jagproject / 28.2.0

jagproject@28.2.0

JagProject Baileys Modification — WhatsApp Web API untuk Node.js dengan dukungan multi-device, pesan, grup, newsletter, dan bisnis.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Video thumbnail generation exposes a shell-injection path during normal runtime media handling. No malicious install-time behavior was confirmed.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A caller sends video media whose local file path contains shell metacharacters.

Impact

Arbitrary commands may run with the host application's privileges.

Mechanism

Unquoted file path passed to ffmpeg through child_process.exec.

Rationale

Source inspection found a concrete runtime command-injection vulnerability, but not evidence of malicious package intent, exfiltration, or install-time compromise.

Evidence

package.jsonengine-requirements.jsscripts/update-wa-version.cjslib/Utils/messages.jslib/Utils/messages-media.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13402

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in jagproject (npm)

Details

The package (a Baileys-family WhatsApp library fork) contains char-code-obfuscated destination strings in lib/Socket/messages-send.js at lines 425 and 436. The byte arrays passed to String.fromCharCode decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host reconstructed at runtime rather than appearing as a plain string literal. The URL is embedded on the message-send code path, meaning normal use of the library's messaging API routes caller-owned session data through an author-controlled endpoint that is deliberately concealed via char-code obfuscation. Obfuscated destinations in a messaging library's send path have no legitimate purpose and match the covert-relay pattern seen in compromised Baileys forks.

Source & flagged code

7 flagged

package.jsonView file

Lines 31-71json

31 "main": "lib/index.js",

32 "types": "lib/index.d.ts",

33 "files": [

34 "lib/**/*",

35 "WAProto/**/*",

36 "engine-requirements.js",

37 "README.md",

38 "LICENSE",

39 "scripts/**/*"

40 ],

41 "scripts": {

42 "build:all": "tsc && typedoc",

43 "build:docs": "typedoc",

44 "build:tsc": "tsc",

45 "changelog:last": "conventional-changelog -p angular -r 2",

46 "changelog:preview": "conventional-changelog -p angular -u",

47 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

48 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

49 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

50 "prepack": "node ./scripts/update-release-metadata.cjs && node ./scripts/update-wa-version.cjs && node ./engine-requirements.js && node ./scripts/validate-package.cjs",

51 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

52 "release": "release-it",

53 "test": "jest",

54 "update:metadata": "node ./scripts/update-release-metadata.cjs",

55 "update:wa-version": "node ./scripts/update-wa-version.cjs",

56 "validate:package": "node ./scripts/validate-package.cjs",

57 "prepublishOnly": "node ./engine-requirements.js",

58 "publish:npm": "npm publish . --access public --registry=https://registry.npmjs.org/"

59 },

60 "dependencies": {

61 "@adiwajshing/keyed-db": "^0.2.4",

62 "@hapi/boom": "^9.1.3",

63 "@cacheable/node-cache": "^1.4.0",

64 "async-mutex": "^0.5.0",

65 "audio-decode": "^2.1.3",

66 "axios": "^1.3.3",

67 "cache-manager": "4.0.1",

68 "chalk": "^4.1.2",

69 "futoin-hkdf": "^1.5.1",

70 "libphonenumber-js": "^1.10.20",

71 "lodash": "^4.17.21",

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = my-auto-follow@1.0.3 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bXktYXV0by1mb2xsb3c:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

scripts/update-wa-version.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = jagproject@28.1.0 matchedIdentity = npm:amFncHJvamVjdA:28.1.0 similarity = 0.980 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/update-wa-version.cjsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.d.tsView on unpkg · L20

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

scripts/update-wa-version.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/update-wa-version.cjsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 31-71json

31 "main": "lib/index.js",

32 "types": "lib/index.d.ts",

33 "files": [

34 "lib/**/*",

35 "WAProto/**/*",

36 "engine-requirements.js",

37 "README.md",

38 "LICENSE",

39 "scripts/**/*"

40 ],

41 "scripts": {

42 "build:all": "tsc && typedoc",

43 "build:docs": "typedoc",

44 "build:tsc": "tsc",

45 "changelog:last": "conventional-changelog -p angular -r 2",

46 "changelog:preview": "conventional-changelog -p angular -u",

47 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

48 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

49 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

50 "prepack": "node ./scripts/update-release-metadata.cjs && node ./scripts/update-wa-version.cjs && node ./engine-requirements.js && node ./scripts/validate-package.cjs",

51 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

52 "release": "release-it",

53 "test": "jest",

54 "update:metadata": "node ./scripts/update-release-metadata.cjs",

55 "update:wa-version": "node ./scripts/update-wa-version.cjs",

56 "validate:package": "node ./scripts/validate-package.cjs",

57 "prepublishOnly": "node ./engine-requirements.js",

58 "publish:npm": "npm publish . --access public --registry=https://registry.npmjs.org/"

59 },

60 "dependencies": {

61 "@adiwajshing/keyed-db": "^0.2.4",

62 "@hapi/boom": "^9.1.3",

63 "@cacheable/node-cache": "^1.4.0",

64 "async-mutex": "^0.5.0",

65 "audio-decode": "^2.1.3",

66 "axios": "^1.3.3",

67 "cache-manager": "4.0.1",

68 "chalk": "^4.1.2",

69 "futoin-hkdf": "^1.5.1",

70 "libphonenumber-js": "^1.10.20",

71 "lodash": "^4.17.21",

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

scripts/update-wa-version.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/update-wa-version.cjsView on unpkg

jagproject@28.2.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code