Loading npm security reports…

plogme@1.0.6: Malicious npm security report (Block) | LPM Firewall

registry / plogme / 1.0.6

plogme@1.0.6

Production-ready Baileys fork ⚉ with AI groups, Meta AI prompting, safe compositing fallbacks, rich responses, interactive messages, albums, newsletters, and communities — without antiban wrappers.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The package automatically follows a maintainer-selected WhatsApp newsletter after the user's authenticated connection opens. It also reports a derived machine fingerprint to a remote operator verifier.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Opening an authenticated WhatsApp socket.

Impact

It changes the user's newsletter subscriptions without an explicit request and exposes stable device-derived telemetry to the operator.

Mechanism

Socket connection handling calls an obfuscated trusted-channel follower and starts remote attestation.

Attack narrative

After authentication, the socket handler automatically joins hard-coded newsletter channels and records completion in credentials. The channel policy is deliberately obfuscated. In the same connection path, remote attestation sends package metadata and a device-derived fingerprint to the maintainer endpoint, allowing remote revocation decisions. These hidden, operator-directed actions are unrelated to ordinary WhatsApp socket functionality.

AI rationale

This is active, unconsented account manipulation combined with obfuscated policy code and remote device telemetry. The behavior is concrete and executes during normal authenticated use.

Evidence

lib/Utils/channel-policy.jslib/Socket/socket.jslib/Utils/integrity.js

Network endpoints1

bailey.crysnovax.link/api/v1/verify

Decision evidence

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = normalized_sha256 matchedPackage = plogme@1.0.5 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:cGxvZ21l:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/messages-media.jsView file

1import { Boom } from '@hapi/boom'; L2: import { spawn } from 'child_process'; L3: import * as Crypto from 'crypto';

High

Child Process

Package source references child process execution.

lib/Utils/messages-media.jsView on unpkg · L1

1import { Boom } from '@hapi/boom'; L2: import { spawn } from 'child_process'; L3: import * as Crypto from 'crypto'; ... L55: hasher.update(data); L56: if (!fileWriteStream.write(data)) { L57: await once(fileWriteStream, 'drain'); ... L88: if (typeof buffer === 'string') { L89: buffer = Buffer.from(buffer.replace('data:;base64,', ''), 'base64'); L90: } ... L115: let buffer = Buffer.alloc(0); L116: const stderrChunks = []; L117: ffmpeg.stdout.on('data', (chunk) => {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/Utils/messages-media.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = plogme@1.0.5 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:cGxvZ21l:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/Utils/validate-connection.jsView file

111pull: false, L112: devicePairingData: { L113: buildHash: appVersionBuf, ... L138: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L139: let hmacPrefix = Buffer.from([]); L140: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L162: ]); L163: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L164: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L111

lib/Utils/channel-policy.jsView file

1const _0x5dbd5a=_0x4193;(function(_0x397f60,_0x361fcf){const _0x9cf7fd=_0x4193,_0x4bb7c2=_0x397f60();while(!![]){try{const _0x27969f=-parseInt(_0x9cf7fd(0x148))/0x1*(parseInt(_0x9c...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/Utils/channel-policy.jsView on unpkg · L1

lib/Utils/integrity.jsView file

41const nodeRequire = createRequire(import.meta.url); L42: const decode = b64 => Buffer.from(b64, 'base64').toString('utf8'); L43: ... L49: author: 'cGxvZ21l', L50: // https://web.crysnovax.link L51: site: '[redacted]=', ... L65: /** Developer escape hatch — set to '1' while actively editing the package. */ L66: export const isTrustMode = () => process.env.CRYSNOVAX_TRUST_MODE === '1'; L67: ... L93: try { L94: // lib/Utils/integrity.js → ../../package.json = package root manifest L95: manifest = nodeRequire('../../package.json');

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/Utils/integrity.jsView on unpkg · L41

•matchType = normalized_sha256 matchedPackage = plogme@1.0.5 matchedPath = lib/Utils/integrity.js matchedIdentity = npm:cGxvZ21l:1.0.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/integrity.jsView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 13262970 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-28json

1{

2 "name": "plogme",

3 "version": "1.0.6",

4 "description": "Production-ready Baileys fork \u2689 with AI groups, Meta AI prompting, safe compositing fallbacks, rich responses, interactive messages, albums, newsletters, and communities \u2014 without antiban wrappers.",

5 "main": "lib/index.js",

6 "type": "module",

7 "scripts": {

8 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "test": "node --test",

10 "obfuscate": "node tools/obfuscate.mjs"

11 },

12 "engines": {

13 "node": ">=20.0.0"

14 },

15 "repository": {

16 "type": "git",

17 "url": "https://github.com/crysnovax/bailey"

18 },

19 "files": [

20 "lib/**/*",

21 "WAProto/**/*",

22 "engine-requirements.js"

23 ],

24 "keywords": [

25 "automation",

26 "baileys",

27 "baileys-fork",

28 "baileys-mod",

lib/WABinary/constants.jsView file

Lines 580-620javascript

580 '044',

581 'mms_cat_v1_forward_hot_override_enabled',

582 'user_notice',

583 'ptt_waveform_send',

584 '047',

585 'Asia/Calcutta',

586

lib/Utils/messages-media.jsView file

Lines 1-21javascript

1import { Boom } from '@hapi/boom';

2import { spawn } from 'child_process';

3import * as Crypto from 'crypto';

High

Child Process

Package source references child process execution.

lib/Utils/messages-media.js

lib/Utils/validate-connection.jsView file

Lines 91-131javascript

91 supportBizHostedMsg: true,

92 supportRecentSyncChunkMessageCountTuning: true,

93 supportHostedGroupMsg: true,

94 supportFbidBotChatHistory: true,

95 supportAddOnHistorySyncMigration

lib/Utils/channel-policy.jsView file

Lines 1-1javascript

1const _0x5dbd5a=_0x4193;(function(_0x397f60,_0x361fcf){const _0x9cf7fd=_0x4193,_0x4bb7c2=_0x397f60();while(!![]){try{const _0x27969f

lib/Utils/integrity.jsView file

Lines 21-61javascript

21 * legitimate edit. Rebranders can set it too — but at that point they

22 * are deliberately tampering, which the license already prohibits.

23 *

24 * Anti-evasion notes:

25 * - The expected identity is stored ENCODED and only decoded at runtime,

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 13262970 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg