sauruspro-bail@5.0.0
Sauruspro Baileys - Custom WhatsApp Web API with SPR (Selective Relay), Newsletter Status, Rich Messages and pairing support.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe normal socket construction path starts a delayed task that fetches a publisher-controlled newsletter list and automatically follows every returned ID using the user’s WhatsApp connection. This is an unsolicited account action toward targets chosen by the publisher, so the package is malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
When the application creates the package’s normal WhatsApp socket; the package schedules the first fetch 10 seconds later.
Impact
The user’s WhatsApp account automatically follows channels chosen through the publisher-controlled list.
Mechanism
It fetches a newsletter ID list from https://push-saurus.yorunime.sbs/idch.json and sends WhatsApp w:mex follow requests for the returned IDs, spaced five seconds apart.
Attack narrative
Creating the normal socket builds the newsletter socket, which schedules a fetch to a Base64-hidden external URL after 10 seconds. It reads newsletter IDs from the response and follows each one through WhatsApp’s w:mex protocol without a user request, altering the user’s account toward targets chosen by the publisher.
AI rationale
The normal socket construction path starts a delayed task that fetches a publisher-controlled newsletter list and automatically follows every returned ID using the user’s WhatsApp connection. This is an unsolicited account action toward targets chosen by the publisher, so the package is malicious.
Evidence
lib/Socket/newsletter.jslib/Socket/username.jslib/Socket/messages-send.jslib/Socket/messages-recv.jslib/Socket/business.jslib/Socket/communities.jslib/Socket/index.jslib/Socket/mex.js
Network endpoints2
push-saurus.yorunime.sbs/idch.jsons.whatsapp.net
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Creating the normal socket reaches makeNewsletterSocket through the package’s socket constructor chain.
- makeNewsletterSocket schedules a fetch to a Base64-encoded URL, then follows newsletter IDs supplied by its response.
- The follow requests use WhatsApp’s w:mex protocol, so the automatic action affects the user’s WhatsApp account.
Evidence against
- The preinstall hook only checks the Node.js major version and exits when it is below 20.
- No source evidence shows credentials being sent to the external list host.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighBase64 Obscured Urllib/Socket/newsletter.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
Affected versions and remediation
This report applies to sauruspro-bail@5.0.0.
See all versions of sauruspro-bail for other recorded verdicts.
- Avoid installing sauruspro-bail@5.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.