lordceaser-baileys@1.0.13
LordCeaser Baileys v1.0.12 - PERMANENT FIXED - Thumbnail GStatus + Payload - Pterodactyl Ready
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a concrete runtime shell-injection risk in its video thumbnail helper, but the inspected code does not show malicious installation behavior, secret theft, or exfiltration. Warn rather than block because activation requires a consumer to pass an unsafe path.
Decision evidence
public snapshot- The video-thumbnail helper interpolates its file path into an ffmpeg shell command and runs it with exec.
- Generating a video thumbnail invokes that shell helper with the supplied file value.
- The manifest has only a prepublishOnly script, so package installation does not run a lifecycle hook.
- Observed network functions support WhatsApp media and version retrieval; no credential harvesting or unrelated exfiltration was found.
- The flagged token constants are WhatsApp protocol strings, not an embedded secret.
Source & flagged code
5 flaggedPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L604Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L604Package contains source files above the normal full-analysis size ceiling.
lib/WAProto/index.jsView on unpkgFindings
Affected versions and remediation
This report applies to lordceaser-baileys@1.0.13.
See all versions of lordceaser-baileys for other recorded verdicts.
- Review the evidence and your use of lordceaser-baileys@1.0.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.