registry / kiki-baileys / 1.0.0

kiki-baileys@1.0.0

Whatsapp baileys coded by Fallzx-Coderid.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A caller that supplies a video path to thumbnail generation may reach an unescaped shell command. This is a command-injection vulnerability, not confirmed package-directed malware behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

An application invokes video thumbnail generation with a path or destination influenced by an attacker.

Impact

An attacker may execute commands with the host application's privileges.

Mechanism

Unescaped path interpolation into an ffmpeg command executed by a shell.

Rationale

The source contains a concrete command-injection flaw in a runtime media helper, so it warrants a warning. Static inspection found no evidence that the package steals data, establishes persistence, or intentionally performs malicious install-time actions.

Evidence

lib/Utils/messages-media.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The media thumbnail helper interpolates file paths into a shell command and passes it to exec, creating command-injection risk.
The package runs an engine-check script automatically during preinstall.

kiki-baileys@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code