registry / keithbaileys / 1.0.9

keithbaileys@1.0.9

A lightweight, full-featured WhatsApp Web API library for Node.js

AI Security Review

scanned 24d ago · by lpm-firewall-ai

A runtime video-thumbnail helper constructs an ffmpeg shell command with unquoted path values. An application that passes attacker-controlled filenames or paths can execute commands as its own user.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

An application invokes video thumbnail generation with an untrusted file path.

Impact

Arbitrary command execution in the consuming application's runtime context.

Mechanism

Shell command injection through unquoted ffmpeg arguments.

AI rationale

This release contains a concrete command-injection vulnerability in a public media-processing path, so it should be warned on. No evidence shows an install hook, exfiltration, persistence, or deliberate malware behavior.

Evidence

lib/Utils/messages-media.js

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The exported video-thumbnail path is interpolated into a shell command passed to exec, allowing command injection if an untrusted filename reaches it.
The manifest has no install lifecycle hook; the risky code runs only when its media helper is invoked.

keithbaileys@1.0.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code