registry / vanzdev / 3.0.4

vanzdev@3.0.4

WhatsApp Web API Library

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Creating the default WhatsApp socket activates a hidden automatic subscription routine. It retrieves third-party IDs then changes the authenticated WhatsApp account to follow and mute them.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

User creates a socket and its WhatsApp connection opens.

Impact

Unconsented account-state changes and remote operator control over subscriptions.

Mechanism

Remote-configured automatic WhatsApp newsletter follow/mute actions.

Attack narrative

The exported default socket reaches makeMessagesSocket, which reaches makeNewsletterSocket. Once a WhatsApp connection opens, that code waits 30 seconds, downloads a list of newsletter IDs from a GitHub-controlled URL, then follows and mutes each valid ID through the authenticated WhatsApp session. The list is remotely changeable and the behavior is not exposed as a user-requested feature.

Rationale

This is a concrete, concealed, remotely controlled action on the user’s WhatsApp account. It is not required for the package’s stated messaging API purpose.

Evidence

lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/index.jspackage.jsonengine-requirements.jslib/Utils/messages-media.js

Network endpoints1

raw.githubusercontent.com/LevviCodeID/Levi4than/refs/heads/main/levvleys.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

lib/Socket/newsletter.js fetches a remote-controlled newsletter-ID list.
On each open connection it follows and mutes every listed newsletter without caller consent.
lib/Socket/messages-send.js wires this behavior into the default socket chain.
The preinstall hook only checks the Node major version; it is unrelated to the attack.

Evidence against

No credential harvesting, shell payload, or AI-agent control-surface write was found in inspected files.
The eval use in lib/Utils/messages-media.js is a fixed optional audio-decoder import.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 93 file(s), 1.38 MB of source, external domains: call.whatsapp.com, catbox.moe, ezgif.com, levvicode.cloud, mmg.whatsapp.net, qu.ax, raw.githubusercontent.com, registry.npmjs.org, scdn.pdi.moe, tmpfiles.org, uguu.se, web.whatsapp.com, www.levvicode.cloud, www.whatsapp.com

Source & flagged code

9 flagged

package.jsonView file

Lines 24-64json

24 "main": "lib/index.js",

25 "types": "lib/index.d.ts",

26 "files": [

27 "lib/*",

28 "WAProto/*",

29 "engine-requirements.js"

30 ],

31 "scripts": {

32 "build:all": "tsc && typedoc",

33 "build:docs": "typedoc",

34 "build:tsc": "tsc",

35 "changelog:last": "conventional-changelog -p angular -r 2",

36 "changelog:preview": "conventional-changelog -p angular -u",

37 "changelog:update": "conventional-changelog -p angular -i CHANGELOG.md -s -r 0",

38 "example": "node --inspect -r ts-node/register Example/example.ts",

39 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

40 "lint": "node -e \"const { execSync } = require('child_process'); execSync('find lib/ -name \\\"*.js\\\" | xargs -I{} node --check {}'); console.log('LINT_OK');\"",

41 "lint:fix": "eslint lib --fix --ext .js",

42 "prepack": "echo 'levvleys WhatsApp Library'",

43 "prepare": "echo 'levvleys WhatsApp Library'",

44 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

45 "release": "release-it",

46 "test": "jest"

47 },

48 "dependencies": {

49 "@adiwajshing/keyed-db": "^0.2.4",

50 "@cacheable/node-cache": "^1.4.0",

51 "@hapi/boom": "^9.1.3",

52 "async-mutex": "^0.5.0",

53 "axios": "^1.6.0",

54 "chalk": "^4.1.2",

55 "gradient-string": "^2.0.2",

56 "cache-manager": "^5.7.6",

57 "cheerio": "^1.0.0-rc.10",

58 "libphonenumber-js": "^1.10.20",

59 "libsignal": "npm:@vanzdev/superfast-libsignal",

60 "lodash": "^4.17.21",

61 "music-metadata": "^7.12.3",

62 "pino": "^9.6",

63 "protobufjs": "^6.11.3",

64 "uuid": "^10.0.0",

lib/WABinary/constants.jsView file

Lines 583-623javascript

583 '044',

584 'mms_cat_v1_forward_hot_override_enabled',

585 'user_notice',

586 'ptt_waveform_send',

587 '047',

588 'Asia/Calcutta',

589

lib/Utils/messages-media.jsView file

Lines 349-389javascript

349};

350exports.mediaMessageSHA256B64 = mediaMessageSHA256B64;

351async function getAudioDuration(buffer) {

352 const musicMetadata = await Promise.

lib/Types/Message.jsView file

Lines 1-8javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.WAMessageStatus = exports.WAMessageStubType = exports.WAProto = void 0

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 301 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 4435234 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = levvleys@2.0.2 matchedPath = lib/Utils/messages.js matchedIdentity = npm:bGV2dmxleXM:2.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L603

603patternName = google_api_key severity = high line = 603 matchedText = 'AIzaSyD...Lk',

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L603

Findings

5 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighKnown Malware Source Similaritylib/Utils/messages-media.js

HighKnown Malware Source Similaritylib/Utils/messages.js

HighSecret Patternlib/WABinary/constants.js

MediumDynamic Requirelib/Types/Message.js

MediumNetwork

MediumShips Build HelperWAProto/GenerateStatics.sh

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvallib/Utils/messages-media.js