registry / megan-baileys / 1.0.4

megan-baileys@1.0.4

Lightweight WhatsApp Web API with multi-session support. Forked from Gifted Baileys 2.5.8 + latest WA protocol. Created by TrackerWanga.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Creating a WhatsApp socket silently schedules remote-controlled newsletter follows. A third-party endpoint supplies target JIDs, and the package acts through the user's authenticated WhatsApp session.

Static reason

One or more suspicious static signals were detected.

Trigger

User calls makeWASocket; the scheduled task runs 90 seconds later.

Impact

Unauthorized actions on the user's WhatsApp account; remote operator controls follow targets.

Mechanism

remote JID list drives unsolicited WhatsApp newsletter-follow requests

Attack narrative

On normal socket creation, messages-send.js constructs the newsletter layer. Its constructor schedules a delayed fetch of a Base64-obscured third-party JSON URL, treats its contents as newsletter JIDs, and sends the same WhatsApp query used by newsletterFollow for each target. Errors are swallowed, obscuring the unconsented account actions.

Rationale

This is concrete remote-controlled, unconsented use of the caller's authenticated WhatsApp account, not a package-aligned newsletter API feature. No install hook is needed for the payload to activate during ordinary runtime use.

Evidence

package.jsonlib/index.jslib/index.mjslib/Socket/messages-send.jslib/Socket/newsletter.js

Network endpoints2

files.gifted.co.ke/file/chJids.jsons.whatsapp.net

megan-baileys@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code