Loading npm security reports…

megan-baileys: Malicious npm security report (Block) | LPM Firewall

registry / megan-baileys / 1.0.11

megan-baileys@1.0.11

Lightweight WhatsApp Web API with multi-session support. Forked from Gifted Baileys 2.5.8 + latest WA protocol. Created by TrackerWanga.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installation overwrites a different package namespace in the consumer's node_modules. Creating a normal WhatsApp socket then schedules a hidden remote-list fetch and authenticated queries.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall; later creation of a WhatsApp socket

Impact

Consumer imports of @whiskeysockets/baileys are redirected; authenticated WhatsApp activity is induced from an attacker-controlled list.

Mechanism

dependency namespace hijack plus covert remote-driven WhatsApp queries

Attack narrative

At install, the package removes the consumer's @whiskeysockets/baileys directory and writes a replacement manifest pointing imports to megan-baileys. When its normal socket construction path reaches makeNewsletterSocket, it waits 90 seconds, decodes and fetches a remote JID list, then sends WhatsApp MEX queries for every returned JID using the consumer's authenticated socket.

Rationale

The lifecycle script silently hijacks another package's namespace, and runtime code performs undisclosed remote-controlled activity through user credentials. These are concrete malicious behaviors, not required Baileys compatibility operations.

Evidence

package.jsonscripts/postinstall.jslib/Socket/newsletter.jslib/Socket/messages-send.jsnode_modules/@whiskeysockets/baileysnode_modules/@whiskeysockets/baileys/package.json

Network endpoints

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = megan-baileys@1.0.6 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bWVnYW4tYmFpbGV5cw:1.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 59bb211ace9433c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = megan-baileys@1.0.8 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bWVnYW4tYmFpbGV5cw:1.0.8 similarity = 1.000 shingleOverlap = 68 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

256try { L257: const { default: decoder } = await eval("import('audio-decode')"); L258: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L256

lib/Socket/newsletter.jsView file

43const fetch = require('node-fetch'); L44: const url = Buffer.from("[redacted]==", 'base64').toString(); L45: const response = await fetch(url);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/Socket/newsletter.jsView on unpkg · L43

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8402946 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = megan-baileys@1.0.6 matchedPath = lib/Utils/messages.js matchedIdentity = npm:bWVnYW4tYmFpbGV5cw:1.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 33-56json

33 "music-metadata": "^7.12.3",

34 "node-fetch": "^2.6.1",

35 "pino": "^9.6",

36 "protobufjs": "^7.2.4",

37 "ws": "^8.13.0"

38 },

39 "exports": {

40 ".": {

41 "import": "./lib/index.mjs",

42 "require": "./lib/index.js",

43 "types": "./lib/index.d.ts"

44 },

45 "./*": {

46 "import": "./lib/*.mjs",

47 "require": "./lib/*.js",

48 "types": "./lib/*.d.ts"

49 }

50 },

51 "module": "./lib/index.mjs",

52 "scripts": {

53 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L53

54 }

55}

56

lib/WABinary/constants.jsView file

Lines 583-623javascript

583 '044',

584 'mms_cat_v1_forward_hot_override_enabled',

585 'user_notice',

586 'ptt_waveform_send',

587 '047',

588 'Asia/Calcutta',

589

lib/Utils/messages-media.jsView file

Lines 236-276javascript

236 const musicMetadata = await Promise.resolve().then(() => __importStar(require('music-metadata')));

237 let metadata;

lib/Socket/newsletter.jsView file

Lines 23-63javascript

23 mute_state: viewer.mute

24 };

25};

26const parseNewsletterMetadata = (result) => {

27 if (typeof result !== 'object'

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8402946 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = megan-baileys@1.0.6 matchedPath = lib/Utils/messages.js matchedIdentity = npm:bWVnYW4tYmFpbGV5cw:1.0.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg