whalibmob@5.33.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

whalibmob@5.33.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

lib/tokens.jsView file

145patternName = google_api_key severity = high line = 145

High

High Secret

Package contains a high-severity secret pattern.

lib/tokens.jsView on unpkg · L145

145patternName = google_api_key severity = high line = 145

High

Secret Pattern

Google API key in lib/tokens.js

lib/tokens.jsView on unpkg · L145

tools/diagnose-405.jsView file

22L23: const path = require('path'); L24: const os = require('os');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/diagnose-405.jsView on unpkg · L22

lib/Registration.jsView file

3const crypto = require('crypto'); L4: const https = require('https'); L5: const tls = require('tls'); ... L103: L104: tlsSocket.write(req); L105: L106: const { status, body: bodyBuf } = await readHttpResponse(tlsSocket, path); L107: const bodyStr = bodyBuf.toString('utf8'); L108: ... L498: L499: const mcc = (opts && opts.simMcc) || process.env.WA_SIM_MCC; L500: const mnc = (opts && opts.simMnc) || process.env.WA_SIM_MNC;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Registration.jsView on unpkg · L3

lib/apns.jsView file

33L34: const https = require('https'); L35: const crypto = require('crypto'); ... L69: // L70: // The private key is a PKCS#1 RSAPrivateKey, DER, base64. It is 1024-bit, which L71: // is not a choice — it is the key that matches the leaf of the chain. L72: L73: const FAIRPLAY_PRIVATE_KEY_PKCS1 = Buffer.from([ L74: '[redacted]', ... L327: res.on('data', c => chunks.push(c)); L328: res.on('end', () => resolve({ status: res.statusCode || 0, body: Buffer.concat(chunks) })); L329: res.on('error', reject);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/apns.jsView on unpkg · L33

lib/AndroidApk.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/AndroidApk.js#virtual:normalized:round1View on unpkg

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = whalibmob@5.33.5 matchedIdentity = npm:d2hhbGlibW9i:5.33.5 similarity = 0.991 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

lib/fcm.jsView file

49patternName = google_api_key severity = high line = 49

High

Secret Pattern

Google API key in lib/fcm.js

lib/fcm.jsView on unpkg · L49

57patternName = google_api_key severity = high line = 57

High

Secret Pattern

Google API key in lib/fcm.js

lib/fcm.jsView on unpkg · L57

Source & flagged code

9 flagged

lib/tokens.jsView file

Lines 125-165javascript

125 '450','fbid:thread','bloks_session_state','America/Lima','attachment_picker_refresh',

126 'download_host_switching_enabled','1792','u_aud_limit_sil_restarts_test2','custom_urls',

127 'device_fanout','optimistic_upload','2000','key_cipher_suite',

128 'web_smb_upsell_in_biz_profile_enabled','e','039','siri_post_status_shortcut','pair-device',

129 'lg','lc','stream_attribution_url','model','mspjpeg_phash_gen','catalog_send_all',

130 'new_multi_vcards_ui','share_biz_vcard_enabled','-','clean','200','md_blocklist_v2_server',

131 '03b','03a','web_md_migration_experience','ptt_conversation_waveform',

132 'u_aud_limit_sil_restarts_test1'

133];

134

135const DICT_2 = [

136 '64','ptt_playback_speed_enabled','web_product_list_message_enabled','paid_convo_ts','27',

137 'manufacturer','psp-routing','grp_uii_cleanup','ptt_draft_enabled','03c',

138 'business_initiated','web_catalog_products_onoff','web_upload_link_thumb_mms_enabled','03e',

139 'mediaretry','35','hfm_string_changes','28','America/Fortaleza','max_keys','md_mhfs_days',

140 'streaming_upload_chunk_size','5541','040','03d','2675','03f','...','512','mute','48','041',

141 'alt_jpeg_quality','60','042','md_smb_quick_reply','5183','c','1343','40','1230','043','044',

142 'mms_cat_v1_forward_hot_override_enabled','user_notice','ptt_waveform_send','047',

143 'Asia/Calcutta','250','md_privacy_v2','31','29','128','md_messaging_enabled','046','crypto',

144 '690','045','enc_iv','75','failure','ptt_oot_playback',

145 'AIzaSyDR5yfaG7OG8sMTUj8kfQEb8T9pN8BM6Lk','w','048','2201','web_large_files_ui',

High

High Secret

Package contains a high-severity secret pattern.

lib/tokens.jsView on unpkg · L145

High

Secret Pattern

Google API key in lib/tokens.js

lib/tokens.jsView on unpkg · L145

146 'Asia/Makassar','812','status_collapse_muted','1334','257','2HP4dm','049','patches','1290',

147 '43cY6T','America/Caracas','web_sticker_maker','campaign','ptt_pausable_enabled','33','42',

148 'attestation','biz','04b','query_linked','s','125','04a','810','availability','1411',

149 'responsiveness_v2_m1','catalog_not_created','34','America/Santiago','1465','enc_p','04d',

150 'status_info','04f','key_version','..','04c','04e','md_group_notification','1598','1215',

151 'web_cart_enabled','37','630','1920','2394','-1','vcard','38','elapsed','36','828','peer',

152 'pricing_category','1245','invalid','stella_ios_enabled','2687','45','1528','39',

153 'u_is_redial_audio_1104_ctrl','1025','1455','58','2524','2603','054',

154 'bsp_system_message_enabled','web_pip_redesign','051','verify_apps','1974','1272','1322',

155 '1755','052','70','050','1063','1135','1361','80','1096','1828','1851','1251','1921',

156 'key_config_id','1254','1566','1252','2525','critical_block','1669','max_available',

157 'w:auth:backup:token','product','2530','870','1022','participant_uuid','web_cart_on_off',

158 '1255','1432','1867','41','1415','1440','240','1204','1608','1690','1846','1483','1687',

159 '1749','69','url_number','053','1325','1040','365','59','Asia/Riyadh','1177',

160 'test_recommended','057','1612','43','1061','1518','1635','055','1034','1375','750','1430',

161 'event_code','1682','503','55','865','78','1309','1365','44','America/Guayaquil','535',

162 'LIMITED','1377','1613','1420','1599','1822','05a','1681','password','1111','1214','1376',

163 '1478','47','1082','4282','Europe/Istanbul','1307','46','058','1124','256','rate-overlimit',

164 'retail','u_a_socket_err_fix_succ_test','1292','1370','1388','520','861','psa','regular',

165 '1181','1766','05b','1183','1213','1304','1537'

tools/diagnose-405.jsView file

Lines 2-42javascript

2'use strict';

3//

4// Asks the server which part of the login it objects to.

5//

6// node tools/diagnose-405.js <phone> [--session <dir>]

7//

8// A 405 says "client outdated" and names nothing else, so the only way to find

9// out what it actually dislikes is to vary one thing at a time and read the

10// answer. Each row below is one login attempt with the session already on disk:

11// nothing is registered, no code is requested, and the session is never

lib/Registration.jsView file

Lines 1-23javascript

1'use strict';

2

3const crypto = require('crypto');

4const https = require('https');

5const

lib/apns.jsView file

Lines 13-53javascript

13// place:

14//

15// 1. activation albert.apple.com signs a device certificate for a keypair

16// we generate, given a FairPlay-signed request. This is what

17// a Mac or an iPhone does on first boot, and what every

18// desktop iMessage/APNs client has done since. The

19// certificate Apple signs is good for a year, so it is

20// persisted with the account and the handshake runs once.

21// 2. courier one TLS connection to Apple carrying the device token, and

22// over it GET_TOKEN for net.whatsapp.WhatsApp — the per-topic

lib/AndroidApk.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/AndroidApk.js#virtual:normalized:round1View on unpkg

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = whalibmob@5.33.5 matchedIdentity = npm:d2hhbGlibW9i:5.33.5 similarity = 0.991 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

lib/fcm.jsView file

Lines 29-77javascript

29// the reason a registration cannot be attempted.

30//

31// The session is persisted with the account. Google hands out an android id

32// once and expects it to keep coming back; re-running checkin on every

33// registration step would mint a new device each time, which is itself a

34// pattern no real phone produces.

35

36const https = require('https');