levvleys@1.1.7: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

levvleys@1.1.7: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L602

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L602

lib/Utils/messages-media.jsView file

200try { L201: const { default: decoder } = await eval("import('audio-decode')"); L202: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L200

lib/Utils/crypto.jsView file

4createCipheriv: createCipheriv, L5: createDecipheriv: createDecipheriv, L6: createHash: createHash, ... L17: return { L18: private: Buffer.from(privKey), L19: public: Buffer.from(pubKey.slice(1)),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L4

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = levvleys@1.1.3 matchedIdentity = npm:bGV2dmxleXM:1.1.3 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 17-57json

17 "type": "git",

18 "url": "git+ssh://git@github.com/LevviCodeID/Baileys.git"

19 },

20 "license": "MIT",

21 "author": "LevviCodeID",

22 "main": "lib/index.js",

23 "directories": {

24 "lib": "lib"

25 },

26 "files": [

27 "lib/*",

28 "WAProto/*",

29 "engine-requirements.js"

30 ],

31 "scripts": {

32 "changelog:last": "conventional-changelog -p angular -r 2",

33 "changelog:preview": "conventional-changelog -p angular -u",

34 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

35 "lint": "eslint src --ext .js,.ts",

36 "lint:fix": "yarn lint --fix",

37 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

38 "release": "release-it",

39 "test": "jest"

40 },

41 "dependencies": {

42 "@hapi/boom": "^9.1.3",

43 "@adiwajshing/keyed-db": "^0.2.4",

44 "@cacheable/node-cache": "1.5.3",

45 "libsignal": "npm:@levvicode/libsignal-node",

46 "async-mutex": "^0.5.0",

47 "audio-decode": "^2.2.2",

48 "cache-manager": "^5.7.6",

49 "fflate": "^0.8.2",

50 "lodash": "^4.17.21",

51 "unfurl.js": "^6.4.0",

52 "lru-cache": "^11.1.0",

53 "music-metadata": "^7.12.3",

54 "pino": "^9.6",

55 "p-queue": "6.1.1",

56 "protobufjs": "^7.2.4",

57 "qrcode-terminal": "^0.12.0",

lib/WABinary/constants.jsView file

Lines 582-622javascript

582 "044",

583 "mms_cat_v1_forward_hot_override_enabled",

584 "user_notice",

585 "ptt_waveform_send",

586 "047",

587 "Asia/Calcutta",

588

lib/Utils/messages-media.jsView file

Lines 180-220javascript

180 }

181 return { img: await img };

182};

183const mediaMessageSHA256B64 = (message) => {

184 const media =

lib/Utils/crypto.jsView file

Lines 1-24javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const {

4 createCipheriv: createCipheriv,

5 createDecipheriv: createDecipheriv,

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = levvleys@1.1.3 matchedIdentity = npm:bGV2dmxleXM:1.1.3 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages.jsView on unpkg