shanks-dev@0.1.3
Baileys fork (shanks-dev) — clean + Channel/Group/Personal Status + Interactive Buttons/Lists/Album/Carousel + Rich code responses + Call Invites + Universal View-Once (0.1.1)
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe package automatically adds publisher-selected newsletter attribution to image and video uploads, using the user’s WhatsApp account to promote a channel without an explicit request. The install hook itself only enforces the documented Node.js version requirement.
Decision evidence
public snapshot- Image and video uploads automatically receive newsletter attribution metadata containing a hardcoded newsletter ID.
- The package’s preinstall hook only checks the Node.js major version and exits if it is below 20.
- The package’s main entry point re-exports modules and the socket factory; no separate import-time action was identified.
Source & flagged code
8 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Source file is highly similar to a previously finalized malicious package; route for source-aware review.
Findings
Affected versions and remediation
This report applies to shanks-dev@0.1.3.
See all versions of shanks-dev for other recorded verdicts.
- Avoid installing shanks-dev@0.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.