registry / jagproject / 28.4.0

jagproject@28.4.0

JagProject Baileys Modification — WhatsApp Web API untuk Node.js dengan dukungan multi-device, pesan, grup, newsletter, dan bisnis.

AI Security Review

scanned 9d ago · by lpm-firewall-ai

A caller-controlled local video path reaches an unquoted shell command during video thumbnail generation. This permits shell metacharacters in the path to execute with the host process's privileges.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Runtime call that sends/prepares a video media message using a local file path.

Impact

Arbitrary command execution in the consuming application's environment.

Mechanism

Shell command injection through child_process.exec.

Rationale

The package is not shown to be intentionally malicious, but it contains a concrete command-injection path exposed by its media API. Its preinstall hook is only a Node-version check.

Evidence

lib/Utils/messages-media.jslib/Utils/messages.jspackage.jsonengine-requirements.js

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

lib/Utils/messages-media.js builds an ffmpeg shell command with unquoted path input.
The command is executed through child_process.exec.

jagproject@28.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code