registry / noxxleys / 1.1.6

noxxleys@1.1.6

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 125 file(s), 5.71 MB of source, external domains: call.whatsapp.com, mmg.whatsapp.net, raw.githubusercontent.com, web.whatsapp.com, www.levvicode.cloud, www.whatsapp.com

Oversized source lightweight scan

WAProto/E2E/E2E.js3.81 MB file, sampled 256 KB

ChildProcess

WAProto/HistorySync/HistorySync.js4.65 MB file, sampled 256 KB

ChildProcess

WAProto/MdStorageMsgRowOpaqueData/MdStorageMsgRowOpaqueData.js3.93 MB file, sampled 256 KB

ChildProcess

WAProto/Web/Web.js4.35 MB file, sampled 256 KB

Source & flagged code

9 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L602

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L602

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = noxleys@1.1.2 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bm94bGV5cw:1.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

200try { L201: const { default: decoder } = await eval("import('audio-decode')"); L202: let audioData;

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/Utils/messages-media.jsView on unpkg · L200

lib/Utils/crypto.jsView file

4createCipheriv: createCipheriv, L5: createDecipheriv: createDecipheriv, L6: createHash: createHash, ... L17: return { L18: private: Buffer.from(privKey), L19: public: Buffer.from(pubKey.slice(1)),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/crypto.jsView on unpkg · L4

WAProto/HistorySync/HistorySync.jsView file

•path = WAProto/HistorySync/HistorySync.js kind = oversized_source_file sizeBytes = 4879942 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/HistorySync/HistorySync.jsView on unpkg

WAProto/E2E/E2E.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/E2E/E2E.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = noxleys@1.1.2 matchedPath = lib/Utils/messages.js matchedIdentity = npm:bm94bGV5cw:1.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L602

602patternName = google_api_key severity = high line = 602 matchedText = "AIzaSyD...Lk",

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L602

Findings

6 High3 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighSemantic Analysis LimitedWAProto/E2E/E2E.js

HighKnown Malware Source Similaritylib/Utils/messages-media.js

HighKnown Malware Source Similaritylib/Utils/messages.js

HighSecret Patternlib/WABinary/constants.js

MediumNetwork

MediumOversized Source FileWAProto/HistorySync/HistorySync.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvallib/Utils/messages-media.js

LowWeak Cryptolib/Utils/crypto.js

LowFilesystem