Loading npm security reports…

kiki-baileys@1.0.2: Malicious npm security report (Block) | LPM Firewall

registry / kiki-baileys / 1.0.2

kiki-baileys@1.0.2

Whatsapp baileys coded by Fallzx-Coderid.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Creating the normal WhatsApp socket silently follows two package-selected newsletters and mutates subscriptions. Sending media can add a package-selected newsletter attribution, while video thumbnailing can execute shell syntax supplied through a path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Create a WhatsApp socket, send media without annotations, or generate a video thumbnail.

Impact

The user's WhatsApp account can follow or unfollow channels without consent; messages can carry injected attribution; crafted paths can run commands with the application user's privileges.

Mechanism

Unconsented account mutation, message metadata injection, and shell command construction.

Attack narrative

The normal socket construction chain reaches the newsletter socket, which decodes two embedded identifiers and follows them on a timer. It also polls subscriptions and unfollows selected channels, without a user action for either change. Separately, media generation inserts a fixed newsletter attribution when callers omit annotations. The thumbnail helper uses a shell command with an unquoted path, exposing the host application to command injection.

Rationale

This package contains concrete, unconsented mutations of a user's WhatsApp subscriptions and message content, plus a reachable shell-injection flaw. These behaviors are unrelated to ordinary messaging-library operation and warrant blocking.

Evidence

lib/Socket/newsletter.jslib/WABinary/jid-utils.jslib/Socket/messages-send.jslib/Utils/messages.jslib/Utils/messages-media.js

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Defaults/baileys-version.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Defaults/baileys-version.jsonView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = kiki-baileys@1.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:a2lraS1iYWlsZXlz:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 04a6852588a9aa30 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = kiki-baileys@1.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:a2lraS1iYWlsZXlz:1.0.1 similarity = 1.000 shingleOverlap = 66 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = kiki-baileys@1.0.1 matchedPath = lib/Utils/messages.js matchedIdentity = npm:a2lraS1iYWlsZXlz:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 20-60json

20 "license": "MIT",

21 "author": "Adhiraj Singh",

22 "main": "lib/index.js",

23 "types": "lib/index.d.ts",

24 "files": [

25 "lib/*",

26 "WAProto/*.js",

27 "engine-requirements.js"

28 ],

29 "scripts": {

30 "build:all": "tsc && typedoc",

31 "build:docs": "typedoc",

32 "build:tsc": "tsc",

33 "changelog:last": "conventional-changelog -p angular -r 2",

34 "changelog:preview": "conventional-changelog -p angular -u",

35 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

36 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

37 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

38 "prepack": "",

39 "prepare": "",

40 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

41 "release": "release-it",

42 "test": "jest"

43 },

44 "dependencies": {

45 "@adiwajshing/keyed-db": "^0.2.4",

46 "@cacheable/node-cache": "^1.4.0",

47 "@hapi/boom": "^9.1.3",

48 "async-mutex": "^0.5.0",

49 "audio-decode": "^2.1.3",

50 "axios": "^1.3.3",

51 "cache-manager": "4.0.1",

52 "chalk": "^4.1.2",

53 "futoin-hkdf": "^1.5.1",

54 "gradient-string": "^3.0.0",

55 "libphonenumber-js": "^1.10.20",

56 "libsignal": "npm:@shennmine/libsignal-node@^0.0.1-security",

57 "lodash": "^4.17.21",

58 "music-metadata": "^7.12.3",

59 "node-cache": "^5.1.2",

60 "node-fetch": "^2.6.1",

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Defaults/baileys-version.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Defaults/baileys-version.jsonView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = kiki-baileys@1.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:a2lraS1iYWlsZXlz:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 04a6852588a9aa30 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = kiki-baileys@1.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:a2lraS1iYWlsZXlz:1.0.1 similarity = 1.000 shingleOverlap = 66 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = kiki-baileys@1.0.1 matchedPath = lib/Utils/messages.js matchedIdentity = npm:a2lraS1iYWlsZXlz:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg