registry / lunaaa-baileys / 1.1.0
lunaaa-baileys@1.1.0
Modded Baileys with interactive message, album, newsletter, and VoIP support
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found ordinary WhatsApp client, media upload, and VoIP behavior, with no concrete attack path. The static similarity and secret-pattern alerts were not supported by malicious behavior in the cited source.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Consumers invoke the exported socket or VoIP APIs.
Impact
No unrelated collection, unauthorized account action, or other concrete attack effect was established.
Mechanism
The inspected media upload code sends media to hosts provided by WhatsApp upload information; protocol tables and generated types support the client implementation.
AI rationale
Source inspection found ordinary WhatsApp client, media upload, and VoIP behavior, with no concrete attack path. The static similarity and secret-pattern alerts were not supported by malicious behavior in the cited source.
Decision evidence
public snapshotAI called this Clean at 82.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json points to the library entry and lists only a build script; lib/index.js exports WhatsApp socket, protocol, utility, and VoIP APIs.
- lib/WAM/constants.js and lib/WABinary/constants.js contain protocol event and binary-token tables; WAProto/index.js imports protobuf support and defines generated protocol types.
- The inspected dependency snapshots expose cache, HTTP error, and mutex functionality, with no install scripts shown in their manifests.
- lib/Utils/messages-media.js constructs media upload requests for hosts supplied by WhatsApp upload information; the inspected code shows no unrelated data recipient.
- The VoIP files implement a worker and WASM runtime; the inspected environment settings configure its runtime behavior.
Evidence against
- Static similarity and secret-pattern alerts do not establish malicious behavior in the inspected source; the flagged constants are protocol tables, and the media upload path uses WhatsApp-provided hosts.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
11 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600lib/VoIP/worker-bootstrap.jsView file
346const code = fs.readFileSync(url, "utf8");
L347: eval(code);
L348: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/VoIP/worker-bootstrap.jsView on unpkg · L346Findings
5 High7 Medium6 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumUnsafe Vm Contextlib/VoIP/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to lunaaa-baileys@1.1.0.
See all versions of lunaaa-baileys for other recorded verdicts.
- Review the evidence and your use of lunaaa-baileys@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.