Loading npm security reports…

noxxleys@1.1.5: Malicious npm security report (Block) | LPM Firewall

registry / noxxleys / 1.1.5

noxxleys@1.1.5

WhatsApp Web API Library

AI Security Review

scanned 2d ago · by lpm-firewall-ai

After a user connects a WhatsApp socket, the package retrieves creator-controlled newsletter IDs and modifies the user's account to follow and mute them. The remote list permits changing targets without a package update.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer creates a WhatsApp socket and its connection opens.

Impact

Unconsented modification of the user's WhatsApp newsletter subscriptions with concealed notifications.

Mechanism

remote-controlled automatic newsletter follow-and-mute actions

Attack narrative

At runtime, the newsletter socket registers a connection-open listener. Thirty seconds after a user connects their WhatsApp account, it fetches a JSON list from the maintainer's GitHub content URL. Each valid newsletter ID is then sent through WhatsApp follow and mute operations. This is not exposed as a user-requested API action and lets the remote list change subscription targets without a new package release.

Rationale

The source contains a concrete, automatic and remotely directed modification of a user's WhatsApp account rather than a package-aligned feature invoked by the caller. The install hook is benign, but it does not mitigate the runtime abuse.

Evidence

lib/Socket/newsletter.jslib/Socket/messages-send.jspackage.jsonengine-requirements.js

Network endpoints1

raw.githubusercontent.com/noxXza/data/refs/heads/main/noxleys.json

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = levvleys@2.0.5 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bGV2dmxleXM:2.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = cecd7f610520c868 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = levvleys@2.0.5 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bGV2dmxleXM:2.0.5 similarity = 1.000 shingleOverlap = 66 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

369try { L370: const { default: decoder } = await eval('import(\'audio-decode\')'); L371: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L369

lib/Types/Message.jsView file

3exports.WAMessageStatus = exports.WAMessageStubType = exports.WAProto = void 0; L4: const WAProto_1 = require("../../WAProto"); L5: Object.defineProperty(exports, "WAProto", { enumerable: true, get: function () { return WAProto_1.proto; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Types/Message.jsView on unpkg · L3

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 301 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435234 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = levvleys@2.0.5 matchedPath = lib/Utils/messages.js matchedIdentity = npm:bGV2dmxleXM:2.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = levvleys@2.0.5 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bGV2dmxleXM:2.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = cecd7f610520c868 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = levvleys@2.0.5 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bGV2dmxleXM:2.0.5 similarity = 1.000 shingleOverlap = 66 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

369try { L370: const { default: decoder } = await eval('import(\'audio-decode\')'); L371: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L369

lib/Types/Message.jsView file

3exports.WAMessageStatus = exports.WAMessageStubType = exports.WAProto = void 0; L4: const WAProto_1 = require("../../WAProto"); L5: Object.defineProperty(exports, "WAProto", { enumerable: true, get: function () { return WAProto_1.proto; } });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/Types/Message.jsView on unpkg · L3

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 301 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435234 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = levvleys@2.0.5 matchedPath = lib/Utils/messages.js matchedIdentity = npm:bGV2dmxleXM:2.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg