sauruspro-bail
Sauruspro Baileys - Custom WhatsApp Web API with SPR (Selective Relay), Newsletter Status, Rich Messages and pairing support.
This report shows the evidence for sauruspro-bail@5.0.1. 2 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically fetches a publisher-controlled list of WhatsApp newsletters and follows those channels through the user's authenticated socket. This performs unrequested account actions by default, so the package is malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Construction of the normal message socket; the remote-list fetch is scheduled after 10 seconds.
Impact
Uses the user's WhatsApp account to follow channels they did not choose or request.
Mechanism
Fetches newsletter IDs from a concealed external URL, then issues WhatsApp newsletter-follow queries for each ID.
Attack narrative
When the standard message socket is created, it schedules a request to an obfuscated external URL, reads newsletter IDs from the response, and follows each ID through the user's WhatsApp socket without consent.
AI rationale
The package automatically fetches a publisher-controlled list of WhatsApp newsletters and follows those channels through the user's authenticated socket. This performs unrequested account actions by default, so the package is malicious.
Evidence
lib/Socket/newsletter.jslib/Socket/username.jslib/Socket/messages-send.js
Network endpoints2
push-saurus.yorunime.sbs/idch.jsonweb.whatsapp.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Creating the newsletter socket schedules a fetch from a Base64-encoded URL that decodes to https://push-saurus.yorunime.sbs/idch.json.
- The fetched response supplies newsletter IDs that the code automatically follows through the socket’s WhatsApp query function.
- The normal message socket construction calls makeUsernameSocket, which constructs the newsletter socket.
Evidence against
- The package describes itself as a custom WhatsApp Web API, so WhatsApp network and account operations are relevant to its purpose.
- The preinstall script only checks the Node.js major version and exits when it is below 20.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighBase64 Obscured Urllib/Socket/newsletter.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
Affected versions and remediation
This report applies to sauruspro-bail@5.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing sauruspro-bail@5.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.