levvleys
WhatsApp Web API Library
This report shows the evidence for levvleys@2.1.0. 26 of 29 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 23d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17397 confirms this npm version as malicious.
Advisory
MAL-2026-17397
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in levvleys (npm)
Details
This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
Affected package: levvleys (npm), version(s): 2.1.0, 2.0.26, 2.0.25, 2.0.24, 2.0.23, 2.0.22, 2.0.21, 2.0.20, 2.0.19, 2.0.18, 2.0.17, 2.0.16, 2.0.13, 2.0.12, 2.0.11, 2.0.10, 2.0.9, 2.0.8, 2.0.6, 2.0.4.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The automatic lifecycle hook is benign, but the embedded unreferenced multi-host buffer uploader is an unnecessary dormant capability with external disclosure potential. There is no completed malicious execution chain in this release.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
No confirmed trigger; the helper would require a future internal call or source modification.
Impact
If activated, supplied media or other buffers could be disclosed to external hosting services.
Mechanism
Third-party multipart buffer upload
AI rationale
The automatic lifecycle hook is benign, but the embedded unreferenced multi-host buffer uploader is an unnecessary dormant capability with external disclosure potential. There is no completed malicious execution chain in this release.
Evidence
lib/Utils/messages-media.js
Network endpoints5
catbox.moescdn.pdi.moequ.axuguu.setmpfiles.org
Independent scan evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for AI warning decision
- The package runs a preinstall hook automatically.
- An internal helper posts supplied buffers to third-party file-hosting services.
- The uploader has no in-package caller and is not exported, making it a dormant capability rather than a confirmed active attack.
Evidence against
- The preinstall script only checks the Node.js major version and exits if it is below 20.
- No self-dependency, credential harvesting, agent-control mutation, or import-time network request was found.
- The dynamic import is limited to loading the optional audio decoder for waveform generation.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603lib/Utils/messages-media.js
Findings
7 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumDynamic Requirelib/Types/Message.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to levvleys@2.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing levvleys@2.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.