registry / lordceaser-baileys / 3.4.8
lordceaser-baileys@3.4.8
LordCeaser Baileys v1.0.2 - Cleanest WhatsApp API with Interactive Buttons, List Menus, GStatus Thumbnail Fix, Music/Video URL Import, Polls & More
AI Security Review
scanned 7d ago · by lpm-firewall-aiSource inspection found no automatic install behavior or concrete attack. The flagged similarity and network signals do not establish malicious behavior; the inspected network calls support explicit library features.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A consumer imports the library and calls its socket or helper functions.
Impact
The inspected behavior supports the package’s WhatsApp client features; no credential theft, unauthorized account action, or install-time attack was established.
Mechanism
The wrapper creates a WhatsApp socket, the status helper sends a group-invite status when called, and the version helper retrieves and parses version text.
AI rationale
Source inspection found no automatic install behavior or concrete attack. The flagged similarity and network signals do not establish malicious behavior; the inspected network calls support explicit library features.
Network endpoints2
chat.whatsapp.comraw.githubusercontent.com/itsliaaa/baileys/main/lib/Defaults/index.js
Decision evidence
public snapshotAI called this Clean at 83.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no automatic install hook; its only lifecycle entry runs a build before publishing.
- index.js exports the WhatsApp socket library and adds a pairing-code wrapper; it does not collect or transmit credentials.
- status-extras.js adds a group-invite status helper that sends only when called, using the supplied invite link and options.
- The latest-version helper fetches version text from the project’s GitHub path and parses a version; it does not execute the response.
- The inspected protocol, cryptography, protobuf, and dependency excerpts show ordinary library implementation and metadata.
Evidence against
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
13 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600•matchType = normalized_sha256
matchedPackage = lordceaser-baileys@3.4.6
matchedPath = lib/WABinary/constants.js
matchedIdentity = npm:bG9yZGNlYXNlci1iYWlsZXlz:3.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/WABinary/constants.jsView on unpkg600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
11 High4 Medium6 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritynode_modules/protobufjs/dist/light/protobuf.js
HighKnown Malware Source Similaritynode_modules/protobufjs/dist/protobuf.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritynode_modules/@protobufjs/fetch/index.js
HighKnown Malware Source Similaritynode_modules/protobufjs/src/util.js
HighKnown Malware Source Similaritylib/WABinary/constants.js
HighKnown Malware Source Similaritynode_modules/protobufjs/src/root.js
HighPrevious Version Dangerous Deltanode_modules/protobufjs/dist/light/protobuf.js
Affected versions and remediation
This report applies to lordceaser-baileys@3.4.8.
See all versions of lordceaser-baileys for other recorded verdicts.
- Review the evidence and your use of lordceaser-baileys@3.4.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.