registry / lordceaser-baileys / 3.4.7
lordceaser-baileys@3.4.7
LordCeaser Baileys v1.0.2 - Cleanest WhatsApp API with Interactive Buttons, List Menus, GStatus Thumbnail Fix, Music/Video URL Import, Polls & More
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found WhatsApp library functionality and no concrete malicious behavior. The only package lifecycle script runs the build before publication; the additional status send is inside an explicitly callable method.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A consumer must call the version lookup or the socket’s sendGroupInviteStatus method; socket creation only attaches the latter.
Impact
These are package-aligned utility actions. The inspected source establishes no unsolicited account action or install-time mutation.
Mechanism
The version utility fetches the fork’s defaults file and parses a numeric version tuple. The status method validates a group invite link, constructs a status message, and relays it to the account and optional caller-provided recipients.
AI rationale
Source inspection found WhatsApp library functionality and no concrete malicious behavior. The only package lifecycle script runs the build before publication; the additional status send is inside an explicitly callable method.
Network endpoints2
raw.githubusercontent.com/itsliaaa/baileys/main/lib/Defaults/index.jschat.whatsapp.com/
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install, preinstall, or postinstall hook; its prepublishOnly script runs the build.
- Inspected package source implements WhatsApp protocol constants, generated message types, Signal key derivation, and video thumbnail extraction.
- Reviewed dependency sources implement caching, in-memory storage, HTTP error objects, and protobuf functionality; protobufjs’s postinstall path is a guarded version warning.
- The entry point normalizes pairing-code arguments and attaches a status method. That method validates a group invite and relays a status message when called.
- The version lookup fetches the fork’s defaults file and parses a numeric version tuple.
Evidence against
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
13 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600•matchType = normalized_sha256
matchedPackage = lordceaser-baileys@3.4.6
matchedPath = lib/WABinary/constants.js
matchedIdentity = npm:bG9yZGNlYXNlci1iYWlsZXlz:3.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/WABinary/constants.jsView on unpkg600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
11 High4 Medium6 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritynode_modules/protobufjs/dist/light/protobuf.js
HighKnown Malware Source Similaritynode_modules/protobufjs/dist/protobuf.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritynode_modules/@protobufjs/fetch/index.js
HighKnown Malware Source Similaritynode_modules/protobufjs/src/util.js
HighKnown Malware Source Similaritylib/WABinary/constants.js
HighKnown Malware Source Similaritynode_modules/protobufjs/src/root.js
HighPrevious Version Dangerous Deltanode_modules/protobufjs/dist/light/protobuf.js
Affected versions and remediation
This report applies to lordceaser-baileys@3.4.7.
See all versions of lordceaser-baileys for other recorded verdicts.
- Review the evidence and your use of lordceaser-baileys@3.4.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.