registry / lunaaa-baileys / 9.0.23
lunaaa-baileys@9.0.23
Modded Baileys with interactive message, album, newsletter, and VoIP support
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found no install-time execution or concrete attack behavior. The flagged network, process, WebAssembly, and generated-code features are consistent with the package’s media and VoIP functions.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer imports the library and invokes its messaging, media, or VoIP APIs.
Impact
These operations provide the package’s messaging and calling features; no unrelated data collection or disclosure was found in the inspected source.
Mechanism
Media code downloads from WhatsApp media hosts and uploads media through its configured upload flow; thumbnail generation invokes ffmpeg, and the VoIP module loads its WebAssembly engine in worker threads.
AI rationale
Source inspection found no install-time execution or concrete attack behavior. The flagged network, process, WebAssembly, and generated-code features are consistent with the package’s media and VoIP functions.
Evidence
package.jsonlib/index.jslib/Utils/messages-media.jslib/WABinary/constants.jslib/WAM/constants.jsWAProto/index.jslib/VoIP/wasm-engine.js.lpm-dependency-evidence-84f01407-a067-476c-8c7f-b1200d67ef50/0/npm-linux/package.json.lpm-dependency-evidence-84f01407-a067-476c-8c7f-b1200d67ef50/0/npm-linux/dist/index.js.lpm-dependency-evidence-84f01407-a067-476c-8c7f-b1200d67ef50/1/npm-linux/package.json.lpm-dependency-evidence-84f01407-a067-476c-8c7f-b1200d67ef50/1/npm-linux/lib/index.js.lpm-dependency-evidence-84f01407-a067-476c-8c7f-b1200d67ef50/2/npm-linux/package.json.lpm-dependency-evidence-84f01407-a067-476c-8c7f-b1200d67ef50/2/npm-linux/index.mjs
Network endpoints1
mmg.whatsapp.net
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies the library entry point and includes only a build script; it has no install lifecycle hook.
- Flagged constants and generated protocol files contain WhatsApp protocol data, while the inspected dependency files implement caching, HTTP errors, and mutexes.
- Media transfers target WhatsApp media infrastructure, and the exported VoIP engine’s WebAssembly and worker usage matches its stated calling functionality.
Evidence against
- The media code uses child_process to invoke ffmpeg for video thumbnail extraction, a user-invoked media processing feature.
- The scanner’s secret-pattern and source-similarity flags were not evidence of secret disclosure or malicious behavior in the inspected source.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStrings
Source & flagged code
11 flaggedlib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600lib/VoIP/worker-bootstrap.jsView file
346const code = fs.readFileSync(url, "utf8");
L347: eval(code);
L348: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/VoIP/worker-bootstrap.jsView on unpkg · L346Findings
5 High7 Medium6 Low
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumUnsafe Vm Contextlib/VoIP/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to lunaaa-baileys@9.0.23.
See all versions of lunaaa-baileys for other recorded verdicts.
- Review the evidence and your use of lunaaa-baileys@9.0.23 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.