noxleys
WhatsApp Web API Library
This report shows the evidence for noxleys@1.1.5. 8 of 8 known versions are blocked or flagged. The newest version, 1.1.6, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains concealed, automatic account mutations and a remotely controlled target list, unrelated to normal WhatsApp client operation. Its lifecycle hook is benign, but the runtime behavior is concrete malicious abuse.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer creates a socket and its WhatsApp connection reaches open state.
Impact
Unauthorized modification of the user's WhatsApp account subscriptions; the remote list can change targets without a package update.
Mechanism
Delayed hidden newsletter follow-and-mute operations, including remote-controlled targets.
Attack narrative
On a successful WhatsApp connection, newsletter.js waits 30 seconds, retrieves arbitrary newsletter IDs from a GitHub-hosted JSON file, then follows and mutes each one. Independently, messages-recv.js conceals two newsletter IDs and the newsletterFollow/newsletterMute method names as character codes, then performs the same actions after connection open. These operations are not user-requested and modify the connected account.
AI rationale
The package contains concealed, automatic account mutations and a remotely controlled target list, unrelated to normal WhatsApp client operation. Its lifecycle hook is benign, but the runtime behavior is concrete malicious abuse.
Evidence
package.jsonengine-requirements.jslib/Socket/newsletter.jslib/Socket/messages-recv.jslib/Socket/index.jslib/Utils/messages-media.js
Network endpoints1
raw.githubusercontent.com/noxXza/data/refs/heads/main/noxleys.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- lib/Socket/newsletter.js fetches a maintainer-controlled remote JSON list on connection.
- lib/Socket/newsletter.js automatically follows and mutes every remotely supplied newsletter ID.
- lib/Socket/messages-recv.js hides two newsletter IDs and method names as character codes.
- lib/Socket/messages-recv.js follows and mutes those hidden IDs 30 seconds after connection opens.
Evidence against
- package.json preinstall only checks the Node major version.
- The eval in lib/Utils/messages-media.js is a fixed optional audio-decode import.
- Other WebSocket and media networking is consistent with a WhatsApp client library.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
matchedText = 'AIzaSyD...Lk',
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
matchedText = 'AIzaSyD...Lk',
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603Findings
6 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumDynamic Requirelib/Types/Message.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
Low
Affected versions and remediation
This report applies to noxleys@1.1.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing noxleys@1.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.