shadowx-baileys@7.0.0-rc13-shadowx.2
ShadowX WhatsApp Web socket library based on the supplied LotusBail RC13 build
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically uses the user's WhatsApp account to follow a newsletter selected by the publisher when the connection opens. This is an unrequested account action and warrants blocking this version.
Static reason
One or more suspicious static signals were detected.
Trigger
The consumer creates the socket and its WhatsApp connection opens; auto-follow is enabled by default.
Impact
The user's account follows the package publisher's chosen newsletter without an explicit request.
Mechanism
The wrapper calls newsletterFollow with the hard-coded newsletter ID, which sends a WhatsApp FOLLOW query.
Attack narrative
When a consumer creates a socket, the package defaults shadowXAutoFollowChannel to true. Once the WhatsApp connection opens, it follows the hard-coded newsletter 120363428922483603@newsletter through the user's account. The follow uses the package's normal WhatsApp connection, but the user did not request this publisher-chosen account action.
AI rationale
The package automatically uses the user's WhatsApp account to follow a newsletter selected by the publisher when the connection opens. This is an unrequested account action and warrants blocking this version.
Evidence
lib/Socket/index.jslib/Socket/newsletter.jslib/Defaults/index.js
Network endpoints1
wss://web.whatsapp.com/ws/chat
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The socket wrapper pins the newsletter ID 120363428922483603@newsletter and defaults shadowXAutoFollowChannel to true.
- When the WhatsApp connection opens, the wrapper calls newsletterFollow for that pinned newsletter.
- newsletterFollow sends a FOLLOW query with the newsletter ID to WhatsApp.
- The default socket endpoint is wss://web.whatsapp.com/ws/chat.
Evidence against
- The preinstall script only checks the Node.js major version and exits on unsupported versions; it does not contact a host or collect data.
Behavioral surface
ChildProcessCryptoDynamicRequireFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
26patternName = google_api_key
severity = high
line = 26
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L2626patternName = google_api_key
severity = high
line = 26
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L26Findings
5 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis LimitedWAProto/index.js
HighSecret Patternlib/WABinary/constants.js
HighSecret Patternlib/WABinary/constants.d.ts
MediumDynamic Requirelib/Types/Events.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to shadowx-baileys@7.0.0-rc13-shadowx.2.
See all versions of shadowx-baileys for other recorded verdicts.
- Avoid installing shadowx-baileys@7.0.0-rc13-shadowx.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.