kiyoramarkets
Websocket Whatsapp API for Node.js
This report shows the evidence for kiyoramarkets@8.0.16. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe automatically scheduled remote fetch and resulting follow actions form a concrete, concealed account-abuse behavior in the package’s runtime path. This supports a malicious verdict; the source shows no install-time trigger or credential exfiltration.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Creating the newsletter socket, followed by an 80-second delay.
Impact
The remote response can cause the connected account to follow selected IDs without an explicit follow request from the caller.
Mechanism
The package decodes a hard-coded URL, fetches JSON from it, and calls the supplied function with each returned ID and the `FOLLOW` action.
Attack narrative
When the newsletter socket is created, `loadBase` schedules a task for 80 seconds later. It decodes a hard-coded raw GitHub URL, fetches JSON, and submits each returned ID to the supplied function with the `FOLLOW` action. This gives the remote response control over follow actions performed through the connected WhatsApp account.
AI rationale
The automatically scheduled remote fetch and resulting follow actions form a concrete, concealed account-abuse behavior in the package’s runtime path. This supports a malicious verdict; the source shows no install-time trigger or credential exfiltration.
Evidence
lib/Utils/messages-media.jslib/Socket/newsletter.js
Network endpoints1
raw.githubusercontent.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `loadBase` waits 80 seconds, decodes a concealed URL, fetches its response, and calls the supplied function with each returned ID and `FOLLOW` in `lib/Utils/messages-media.js`.
- `lib/Socket/newsletter.js` invokes `loadBase` while creating the newsletter socket, so the behavior is reached through package functionality.
- `package.json` exposes `lib/index.js` and has no preinstall, install, or postinstall lifecycle hook.
Evidence against
- The package describes itself as a WhatsApp websocket API, and the manifest identifies its GitHub repository.
- The inspected manifest contains no npm install lifecycle hook.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
GitDependencyWildcardDependency
Source & flagged code
8 flagged · loading sourcelib/WABinary/constants.jsView file
601patternName = google_api_key
severity = high
line = 601
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L601601patternName = google_api_key
severity = high
line = 601
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L601lib/Utils/crypto.jsView file
1//=======================================================//
L2: import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from "crypto";
L3: import { KEY_BUNDLE_TYPE } from "../Defaults/index.js";
...
L11: return {
L12: private: Buffer.from(privKey),
L13: public: Buffer.from(pubKey.slice(1))
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/Utils/crypto.jsFindings
6 High5 Medium5 Low
HighHigh Secretlib/WABinary/constants.js
HighBase64 Obscured Urllib/Utils/messages-media.js
HighNode Builtin Dependency Squatpackage.json
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
MediumWildcard Dependency
LowScripts Present
LowWeak Cryptolib/Utils/crypto.js
LowFilesystem
Affected versions and remediation
This report applies to kiyoramarkets@8.0.16.
The versions list below shows the verdict for each recorded version.
- Avoid installing kiyoramarkets@8.0.16. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.