Loading npm security reports…

noverojava@1.0.9: Malicious npm security report (Block) | LPM Firewall

registry / noverojava / 1.0.9

noverojava@1.0.9

WhatsApp API Modification By Noverojava

AI Security Review

scanned 16d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The install hook only checks the local Node.js major version; runtime media networking is feature-driven.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Package installation runs the Node.js version check; WhatsApp media operations require caller input.

Impact

No automatic credential theft, persistence, destructive action, or unconsented data transfer was found.

Mechanism

Local runtime compatibility check and user-invoked WhatsApp media handling.

AI rationale

The high-risk scanner paths contain ordinary WhatsApp media and protocol functionality, while the only install-time hook is a local version guard. The import-time Telegram banner is undesirable promotion but does not establish an attack.

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16389

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in noverojava (npm)

Details

package.json declares the runtime dependency `libsignal` as `github:tenka-san/libsignal-node` rather than a registry version range or pinned commit SHA. On `npm install`, npm fetches the current HEAD of that fork's default branch and executes any lifecycle scripts it defines. The fork is under a third-party GitHub account (not the upstream WhiskeySockets libsignal-node maintainer), has no commit pin, and no integrity check, so whoever controls that account controls code that runs on the installer's machine at install time. The package presents as a Baileys/WhatsApp library fork; the static match on lib/Utils/generics.js line 403 (ping/GET tokens) is consistent with normal Baileys network code and is not independently indicative of exfiltration.

Source & flagged code

8 flagged

package.jsonView file

Lines 18-58json

18 "author": "noverojava",

19 "main": "lib/index.js",

20 "types": "lib/index.d.ts",

21 "files": [

22 "lib/**/*",

23 "WAProto/*.js",

24 "WAProto/*.d.ts",

25 "engine-requirements.js"

26 ],

27 "scripts": {

28 "build:all": "tsc && typedoc",

29 "build:docs": "typedoc",

30 "build:tsc": "tsc",

31 "changelog:last": "conventional-changelog -p angular -r 2",

32 "changelog:preview": "conventional-changelog -p angular -u",

33 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

34 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

35 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

36 "prepack": "",

37 "prepare": "",

38 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "release": "release-it",

40 "test": "jest"

41 },

42 "dependencies": {

43 "@cacheable/node-cache": "^1.4.0",

44 "@hapi/boom": "^9.1.3",

45 "async-mutex": "^0.5.0",

46 "libsignal": "github:tenka-san/libsignal-node",

47 "lru-cache": "^11.1.0",

48 "music-metadata": "^11.12.3",

49 "p-queue": "^9.0.0",

50 "pino": "^9.6",

51 "protobufjs": "^7.5.6",

52 "whatsapp-rust-bridge": "0.5.4",

53 "ws": "^8.13.0",

54 "chalk": "^4.1.2",

55 "cache-manager": "^7.2.8"

56 },

57 "devDependencies": {

58 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @xayz/baileys@6.0.1 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QHhheXovYmFpbGV5cw:6.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = noverojava@1.0.8 matchedIdentity = npm:bm92ZXJvamF2YQ:1.0.8 similarity = 0.709 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 18-58json

18 "author": "noverojava",

19 "main": "lib/index.js",

20 "types": "lib/index.d.ts",

21 "files": [

22 "lib/**/*",

23 "WAProto/*.js",

24 "WAProto/*.d.ts",

25 "engine-requirements.js"

26 ],

27 "scripts": {

28 "build:all": "tsc && typedoc",

29 "build:docs": "typedoc",

30 "build:tsc": "tsc",

31 "changelog:last": "conventional-changelog -p angular -r 2",

32 "changelog:preview": "conventional-changelog -p angular -u",

33 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

34 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

35 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

36 "prepack": "",

37 "prepare": "",

38 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

39 "release": "release-it",

40 "test": "jest"

41 },

42 "dependencies": {

43 "@cacheable/node-cache": "^1.4.0",

44 "@hapi/boom": "^9.1.3",

45 "async-mutex": "^0.5.0",

46 "libsignal": "github:tenka-san/libsignal-node",

47 "lru-cache": "^11.1.0",

48 "music-metadata": "^11.12.3",

49 "p-queue": "^9.0.0",

50 "pino": "^9.6",

51 "protobufjs": "^7.5.6",

52 "whatsapp-rust-bridge": "0.5.4",

53 "ws": "^8.13.0",

54 "chalk": "^4.1.2",

55 "cache-manager": "^7.2.8"

56 },

57 "devDependencies": {

58 "@eslint/eslintrc": "^3.3.1",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/validate-connection.jsView file

Lines 87-127javascript

87 supportBizHostedMsg: true,

88 supportRecentSyncChunkMessageCountTuning: true,

89 supportHostedGroupMsg: true,

90 supportFbidBotChatHistory: true,

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 12145764 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

noverojava@1.0.9

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code