ruby-baileys@1.5.17
WhatsApp Web API — Ruby-Baileys by Kyuu. 100% Powered by @rexxhayanasi/elaina-baileys with integrated MessageBuilder, native flow, VoIP calling, and database auth stores.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe socket-open handler automatically follows two hardcoded WhatsApp newsletters using the user's account. This is an unrequested account action toward publisher-chosen targets, so the package is malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A socket created by makeWASocket reaches the open connection state.
Impact
The user's WhatsApp account joins channels without a request to do so.
Mechanism
The handler looks up two hardcoded newsletter invite codes and calls newsletterFollow for each resolved ID.
Attack narrative
When a socket connection opens, the package looks up two hardcoded newsletter invites and follows the resolved channels through the user's WhatsApp account without an explicit request.
AI rationale
The socket-open handler automatically follows two hardcoded WhatsApp newsletters using the user's account. This is an unrequested account action toward publisher-chosen targets, so the package is malicious.
Evidence
src/Socket/index.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The connection-open handler hardcodes two WhatsApp newsletter invite codes.
- It looks up each invite and automatically follows the newsletter when metadata is returned.
- The handler is attached while makeWASocket constructs the socket.
Evidence against
- The preinstall script only checks the Node.js version and exits on versions below 20.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
Source & flagged code
13 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/Voip/worker-bootstrap.jsView file
337const code = fs.readFileSync(url, "utf8");
L338: eval(code);
L339: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/Voip/worker-bootstrap.jsView on unpkg · L337src/Utils/auth-store.jsView file
18try {
L19: const mod = await import(name);
L20: return mod.default ?? mod;
Medium
Findings
6 High8 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritysrc/Utils/messages-media.js
HighKnown Malware Source Similaritysrc/Voip/audio-feeder.js
HighKnown Malware Source Similaritysrc/Voip/video-feeder.js
HighKnown Malware Source Fingerprint Signaturesrc/Utils/messages-media.js
MediumDynamic Requiresrc/Utils/auth-store.js
MediumUnsafe Vm Contextsrc/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulesrc/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
Affected versions and remediation
This report applies to ruby-baileys@1.5.17.
See all versions of ruby-baileys for other recorded verdicts.
- Avoid installing ruby-baileys@1.5.17. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.