registry / parxleys / 1.0.1

parxleys@1.0.1

WhatsApp Web API Library

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The normal WhatsApp socket automatically follows remotely selected channels and mutes them. This is unsolicited manipulation of the connected user's account.

Static reason

One or more suspicious static signals were detected.

Trigger

A WhatsApp connection opens, followed by a 30-second timer.

Impact

Changes the user's channel subscriptions and notification settings without an explicit request.

Mechanism

Fetch a remote JSON channel list and issue authenticated FOLLOW and MUTE queries for its entries.

Attack narrative

Creating the normal socket registers a connection listener. After the connection opens, the listener fetches an external channel list and uses the authenticated socket to follow and mute those channels. Remote list changes can therefore determine unsolicited account subscriptions without a separate user command.

AI rationale

Source proves automatic, remotely directed account manipulation through the active socket entrypoint. The benign lifecycle and media-processing findings do not explain or neutralize this behavior.

Evidence

lib/index.jslib/Socket/index.jslib/Socket/business.jslib/Socket/messages-recv.jslib/Socket/messages-send.jslib/Socket/newsletter.js

Network endpoints1

raw.githubusercontent.com/noxXza/data/refs/heads/main/noxleys.json

parxleys@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code