registry / lordceaser-baileys / 3.4.9
lordceaser-baileys@3.4.9
LordCeaser Baileys v1.0.2 - Cleanest WhatsApp API with Interactive Buttons, List Menus, GStatus Thumbnail Fix, Music/Video URL Import, Polls & More
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package has no install-time hook that performs external actions, and its import-time behavior only prints a banner and attaches socket helpers. Reviewed network and account actions serve the WhatsApp client’s stated purpose and are invoked through its API; the flagged token string is protocol data, not a credential.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Normal package import prints a banner and attaches socket helpers; network and account actions occur when callers use the relevant client methods.
Impact
No unintended data collection, credential transfer, or automatic account action was identified.
Mechanism
The status helper builds a broadcast from a caller-provided invite and recipient list. The version helper fetches version metadata from the project’s GitHub repository.
AI rationale
The package has no install-time hook that performs external actions, and its import-time behavior only prints a banner and attaches socket helpers. Reviewed network and account actions serve the WhatsApp client’s stated purpose and are invoked through its API; the flagged token string is protocol data, not a credential.
Network endpoints3
web.whatsapp.comraw.githubusercontent.com/itsliaaa/baileys/main/lib/Defaults/index.jschat.whatsapp.com
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The only declared lifecycle script is prepublishOnly, which runs the TypeScript build; there is no install hook.
- Importing the package wraps socket creation and attaches a helper method, but does not call that helper.
- The status helper acts on a group invite and recipient list supplied by its caller.
- The status broadcast occurs inside the explicitly invoked sendGroupInviteStatus method.
- The flagged secret-like string appears among WhatsApp binary protocol tokens.
- The version helper fetches this project’s defaults file from its GitHub repository to obtain a version.
Evidence against
- The package is a WhatsApp client library, so WhatsApp network requests and account actions are part of its stated purpose.
- The manifest declares a GitHub dependency on libsignal, but the reviewed source shows no install-time data collection or unrelated endpoint.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
Source & flagged code
12 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600•matchType = normalized_sha256
matchedPackage = lordceaser-baileys@3.4.6
matchedPath = lib/WABinary/constants.js
matchedIdentity = npm:bG9yZGNlYXNlci1iYWlsZXlz:3.4.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/WABinary/constants.jsView on unpkg600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
10 High4 Medium6 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritynode_modules/protobufjs/dist/light/protobuf.js
HighKnown Malware Source Similaritynode_modules/protobufjs/dist/protobuf.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritynode_modules/@protobufjs/fetch/index.js
HighKnown Malware Source Similaritynode_modules/protobufjs/src/util.js
HighKnown Malware Source Similaritylib/WABinary/constants.js
HighKnown Malware Source Similaritynode_modules/protobufjs/src/root.js
HighSecret Patternlib/WABinary/constants.js
Medium
Affected versions and remediation
This report applies to lordceaser-baileys@3.4.9.
See all versions of lordceaser-baileys for other recorded verdicts.
- Review the evidence and your use of lordceaser-baileys@3.4.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.