registry / jagproject / 28.8.2

jagproject@28.8.2

JagProject Baileys Modification — WhatsApp Web API untuk Node.js dengan dukungan multi-device, pesan, grup, newsletter, dan bisnis.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

A runtime video-thumbnail path reaches a shell command without quoting. No malicious install-time behavior is established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Application code processes a video using a crafted local file path.

Impact

Arbitrary command execution with the host application's privileges.

Mechanism

shell command injection through ffmpeg command construction

Rationale

The package is not shown to be malicious, but it contains a credible arbitrary-command-execution path in runtime media processing. Warn rather than block because the behavior requires an application-level crafted input and is not triggered during installation.

Evidence

package.jsonengine-requirements.jslib/Utils/messages-media.jslib/index.jslib/Utils/generics.jsscripts/update-wa-version.cjsscripts/validate-package.cjs

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

jagproject@28.8.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code