lordceaser-baileys@3.4.6
LordCeaser Baileys v1.0.2 - Cleanest WhatsApp API with Interactive Buttons, List Menus, GStatus Thumbnail Fix, Music/Video URL Import, Polls & More
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource inspection confirms that missing message URLs are replaced with the package's donation link and that the modified message is sent through the user's WhatsApp account. This is unrequested publisher-selected content in outgoing messages, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
An application sends a message containing an offer, ad reply, or rich link without specifying its URL.
Impact
Recipients may receive an undisclosed publisher-selected fundraising link through the user's WhatsApp account.
Mechanism
The package substitutes its fixed donation destination for the missing URL and includes it in the outgoing message.
Attack narrative
When an application sends supported promotional or link content without a URL, the package supplies its own donation destination. The normal send path relays the resulting message to the caller's chosen chat, so recipients can see a fundraising link the caller did not select.
AI rationale
Source inspection confirms that missing message URLs are replaced with the package's donation link and that the modified message is sent through the user's WhatsApp account. This is unrequested publisher-selected content in outgoing messages, so the package should be blocked.
Evidence
lib/Defaults/index.jslib/Utils/messages.jslib/Utils/rich-message-utils.jslib/Socket/messages-send.js
Network endpoints1
saweria.co/itsliaaa
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package sets its donation destination to https://saweria.co/itsliaaa.
- When promotional or link content omits a URL, message builders fill it with the package's donation destination.
- The send path builds a message from caller-provided content and relays it to the requested chat.
Evidence against
- The insertion is conditional on caller-provided promotional or link content with no URL; the package does not directly contact the donation site.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js
Source & flagged code
8 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600•matchType = normalized_sha256
matchedPackage = @jexkcode/baileys@1.3.0
matchedPath = lib/WABinary/constants.js
matchedIdentity = npm:QGpleGtjb2RlL2JhaWxleXM:1.3.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/WABinary/constants.jsView on unpkg600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High4 Medium6 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/WABinary/constants.js
HighPrevious Version Dangerous Deltanode_modules/protobufjs/dist/light/protobuf.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
Affected versions and remediation
This report applies to lordceaser-baileys@3.4.6.
See all versions of lordceaser-baileys for other recorded verdicts.
- Avoid installing lordceaser-baileys@3.4.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.