registry / whalibmob / 5.26.1

whalibmob@5.26.1

⚠ Under review

Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 98 file(s), 2.24 MB of source, external domains: android.clients.google.com, auroraoss.com, call.whatsapp.com, chat.whatsapp.com, firebaseinstallations.googleapis.com, itunes.apple.com, play.google.com, v.whatsapp.net, wa.me, web.whatsapp.com, www.whatsapp.com

Source & flagged code

8 flagged

lib/tokens.jsView file

Lines 125-165javascript

125 '450','fbid:thread','bloks_session_state','America/Lima','attachment_picker_refresh',

126 'download_host_switching_enabled','1792','u_aud_limit_sil_restarts_test2','custom_urls',

127 'device_fanout','optimistic_upload','2000','key_cipher_suite',

128 'web_smb_upsell_in_biz_profile_enabled','e','039','siri_post_status_shortcut','pair-device',

129 'lg','lc','stream_attribution_url','model','mspjpeg_phash_gen','catalog_send_all',

130 'new_multi_vcards_ui','share_biz_vcard_enabled','-','clean','200','md_blocklist_v2_server',

131 '03b','03a','web_md_migration_experience','ptt_conversation_waveform',

132 'u_aud_limit_sil_restarts_test1'

133];

134

135const DICT_2 = [

136 '64','ptt_playback_speed_enabled','web_product_list_message_enabled','paid_convo_ts','27',

137 'manufacturer','psp-routing','grp_uii_cleanup','ptt_draft_enabled','03c',

138 'business_initiated','web_catalog_products_onoff','web_upload_link_thumb_mms_enabled','03e',

139 'mediaretry','35','hfm_string_changes','28','America/Fortaleza','max_keys','md_mhfs_days',

140 'streaming_upload_chunk_size','5541','040','03d','2675','03f','...','512','mute','48','041',

141 'alt_jpeg_quality','60','042','md_smb_quick_reply','5183','c','1343','40','1230','043','044',

142 'mms_cat_v1_forward_hot_override_enabled','user_notice','ptt_waveform_send','047',

143 'Asia/Calcutta','250','md_privacy_v2','31','29','128','md_messaging_enabled','046','crypto',

144 '690','045','enc_iv','75','failure','ptt_oot_playback',

145 'AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk','w','048','2201','web_large_files_ui',

High

High Secret

Package contains a high-severity secret pattern.

lib/tokens.jsView on unpkg · L145

High

Secret Pattern

Google API key in lib/tokens.js

lib/tokens.jsView on unpkg · L145

146 'Asia/Makassar','812','status_collapse_muted','1334','257','2HP4dm','049','patches','1290',

147 '43cY6T','America/Caracas','web_sticker_maker','campaign','ptt_pausable_enabled','33','42',

148 'attestation','biz','04b','query_linked','s','125','04a','810','availability','1411',

149 'responsiveness_v2_m1','catalog_not_created','34','America/Santiago','1465','enc_p','04d',

150 'status_info','04f','key_version','..','04c','04e','md_group_notification','1598','1215',

151 'web_cart_enabled','37','630','1920','2394','-1','vcard','38','elapsed','36','828','peer',

152 'pricing_category','1245','invalid','stella_ios_enabled','2687','45','1528','39',

153 'u_is_redial_audio_1104_ctrl','1025','1455','58','2524','2603','054',

154 'bsp_system_message_enabled','web_pip_redesign','051','verify_apps','1974','1272','1322',

155 '1755','052','70','050','1063','1135','1361','80','1096','1828','1851','1251','1921',

156 'key_config_id','1254','1566','1252','2525','critical_block','1669','max_available',

157 'w:auth:backup:token','product','2530','870','1022','participant_uuid','web_cart_on_off',

158 '1255','1432','1867','41','1415','1440','240','1204','1608','1690','1846','1483','1687',

159 '1749','69','url_number','053','1325','1040','365','59','Asia/Riyadh','1177',

160 'test_recommended','057','1612','43','1061','1518','1635','055','1034','1375','750','1430',

161 'event_code','1682','503','55','865','78','1309','1365','44','America/Guayaquil','535',

162 'LIMITED','1377','1613','1420','1599','1822','05a','1681','password','1111','1214','1376',

163 '1478','47','1082','4282','Europe/Istanbul','1307','46','058','1124','256','rate-overlimit',

164 'retail','u_a_socket_err_fix_succ_test','1292','1370','1388','520','861','psa','regular',

165 '1181','1766','05b','1183','1213','1304','1537'

tools/diagnose-405.jsView file

Lines 2-42javascript

2'use strict';

3//

4// Asks the server which part of the login it objects to.

5//

6// node tools/diagnose-405.js <phone> [--session <dir>]

7//

8// A 405 says "client outdated" and names nothing else, so the only way to find

9// out what it actually dislikes is to vary one thing at a time and read the

10// answer. Each row below is one login attempt with the session already on disk:

11// nothing is registered, no code is requested, and the session is never

lib/Registration.jsView file

Lines 1-23javascript

1'use strict';

3const crypto = require('crypto');

4const https = require('https');

5const

lib/AndroidApk.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/AndroidApk.js#virtual:normalized:round1View on unpkg

lib/Client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = whalibmob@5.29.6 matchedIdentity = npm:d2hhbGlibW9i:5.29.6 similarity = 0.838 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Client.jsView on unpkg

lib/fcm.jsView file

Lines 29-77javascript

29// the reason a registration cannot be attempted.

30//

31// The session is persisted with the account. Google hands out an android id

32// once and expects it to keep coming back; re-running checkin on every

33// registration step would mint a new device each time, which is itself a

34// pattern no real phone produces.

36const https = require('https');

Source & flagged code

8 flagged · loading source

lib/tokens.jsView file

whalibmob@5.26.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code