Loading npm security reports…

jagproject@28.7.0: Malicious npm security report (Block) | LPM Firewall

registry / jagproject / 28.7.0

jagproject@28.7.0

JagProject Baileys Modification — WhatsApp Web API untuk Node.js dengan dukungan multi-device, pesan, grup, newsletter, dan bisnis.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

Exported video thumbnail generation can execute shell-injected commands through an unquoted file path. This is runtime-only, not install-time behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A caller invokes generateThumbnail with mediaType 'video' and an attacker-controlled file path.

Impact

Arbitrary command execution with the host application's permissions.

Mechanism

Shell command injection via child_process.exec

Rationale

The package is not shown to be intentionally malicious, but it contains a concrete runtime command-injection vulnerability in an exported API. Lifecycle code only enforces Node.js version requirements.

Evidence

package.jsonengine-requirements.jslib/Utils/messages-media.jslib/Utils/generics.jsscripts/update-wa-version.cjs

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13402

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in jagproject (npm)

Details

lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline.

Source & flagged code

6 flagged

package.jsonView file

Lines 31-71json

31 "main": "lib/index.js",

32 "types": "lib/index.d.ts",

33 "files": [

34 "lib/**/*",

35 "WAProto/**/*",

36 "engine-requirements.js",

37 "README.md",

38 "LICENSE",

39 "scripts/**/*"

40 ],

41 "scripts": {

42 "build:all": "tsc && typedoc",

43 "build:docs": "typedoc",

44 "build:tsc": "tsc",

45 "changelog:last": "conventional-changelog -p angular -r 2",

46 "changelog:preview": "conventional-changelog -p angular -u",

47 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

48 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

49 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

50 "prepack": "node ./scripts/update-release-metadata.cjs && node ./scripts/update-wa-version.cjs && node ./engine-requirements.js && node ./scripts/validate-package.cjs",

51 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

52 "release": "release-it",

53 "test": "jest",

54 "update:metadata": "node ./scripts/update-release-metadata.cjs",

55 "update:wa-version": "node ./scripts/update-wa-version.cjs",

56 "validate:package": "node ./scripts/validate-package.cjs",

57 "prepublishOnly": "node ./engine-requirements.js",

58 "publish:npm": "npm publish . --access public --registry=https://registry.npmjs.org/"

59 },

60 "dependencies": {

61 "@adiwajshing/keyed-db": "^0.2.4",

62 "@hapi/boom": "^9.1.3",

63 "@cacheable/node-cache": "^1.4.0",

64 "async-mutex": "^0.5.0",

65 "audio-decode": "^2.1.3",

66 "axios": "^1.3.3",

67 "cache-manager": "4.0.1",

68 "chalk": "^4.1.2",

69 "futoin-hkdf": "^1.5.1",

70 "libphonenumber-js": "^1.10.20",

71 "lodash": "^4.17.21",

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = my-auto-follow@1.0.3 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bXktYXV0by1mb2xsb3c:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.d.tsView file

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.d.tsView on unpkg · L20

20patternName = google_api_key severity = high line = 20 matchedText = export d..."]];

High

Secret Pattern

Google API key in lib/WABinary/constants.d.ts

lib/WABinary/constants.d.tsView on unpkg · L20

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 31-71json

31 "main": "lib/index.js",

32 "types": "lib/index.d.ts",

33 "files": [

34 "lib/**/*",

35 "WAProto/**/*",

36 "engine-requirements.js",

37 "README.md",

38 "LICENSE",

39 "scripts/**/*"

40 ],

41 "scripts": {

42 "build:all": "tsc && typedoc",

43 "build:docs": "typedoc",

44 "build:tsc": "tsc",

45 "changelog:last": "conventional-changelog -p angular -r 2",

46 "changelog:preview": "conventional-changelog -p angular -u",

47 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

48 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

49 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

50 "prepack": "node ./scripts/update-release-metadata.cjs && node ./scripts/update-wa-version.cjs && node ./engine-requirements.js && node ./scripts/validate-package.cjs",

51 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L51

52 "release": "release-it",

53 "test": "jest",

54 "update:metadata": "node ./scripts/update-release-metadata.cjs",

55 "update:wa-version": "node ./scripts/update-wa-version.cjs",

56 "validate:package": "node ./scripts/validate-package.cjs",

57 "prepublishOnly": "node ./engine-requirements.js",

58 "publish:npm": "npm publish . --access public --registry=https://registry.npmjs.org/"

59 },

60 "dependencies": {

61 "@adiwajshing/keyed-db": "^0.2.4",

62 "@hapi/boom": "^9.1.3",

63 "@cacheable/node-cache": "^1.4.0",

64 "async-mutex": "^0.5.0",

65 "audio-decode": "^2.1.3",

66 "axios": "^1.3.3",

67 "cache-manager": "4.0.1",

68 "chalk": "^4.1.2",

69 "futoin-hkdf": "^1.5.1",

70 "libphonenumber-js": "^1.10.20",

71 "lodash": "^4.17.21",

lib/WABinary/constants.d.tsView file

Lines 1-28typescript

1export declare const TAGS: {

2 LIST_EMPTY: number;

3 DICTIONARY_0: number;

4 DICTIONARY_1:

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

jagproject@28.7.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code