Loading npm security reports…

ynastore-baileys@1.0.21: Malicious npm security report (Block) | LPM Firewall

registry / ynastore-baileys / 1.0.21

ynastore-baileys@1.0.21

WhatsApp API Modification

AI Security Review

scanned 9d ago · by lpm-firewall-ai

A caller that supplies a crafted local video filename to media processing can influence an ffmpeg command executed through a shell. No install-time attack surface is established.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Application code invokes video media-message preparation with a crafted local file path.

Impact

Arbitrary shell command execution with the host application's privileges.

Mechanism

unsafely interpolated filename passed to child_process.exec

Rationale

The package is not shown to contain malicious install-time or covert behavior, but it exposes a concrete runtime shell-injection vulnerability through normal media processing.

Evidence

lib/Utils/messages-media.jslib/Utils/messages.jspackage.jsonengine-requirements.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13470

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in ynastore-baileys (npm)

Details

ynastore-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 and 436 reconstruct a network destination via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47...), which decodes to https://fiora.nixel.my.id/. Encoding a network host as a decimal char-code array to hide it from source-tree inspection is the exfiltration/silent-relay obfuscation pattern; a legitimate first-party endpoint in a WhatsApp library would appear as a plain URL literal. The host fiora.nixel.my.id is not a Baileys/WhatsApp-associated domain, and the messages-send code path is invoked as part of the library's normal send flow, so message-related data belonging to consumers of this fork is routed to an author-controlled destination during ordinary use.

Source & flagged code

3 flagged

package.jsonView file

Lines 13-53json

13 "license": "MIT",

14 "author": "Yna Dev",

15 "main": "lib/index.js",

16 "types": "lib/index.d.ts",

17 "files": [

18 "lib/*",

19 "WAProto/*.js",

20 "engine-requirements.js"

21 ],

22 "scripts": {

23 "build:all": "tsc && typedoc",

24 "build:docs": "typedoc",

25 "build:tsc": "tsc",

26 "changelog:last": "conventional-changelog -p angular -r 2",

27 "changelog:preview": "conventional-changelog -p angular -u",

28 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

29 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

30 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

31 "prepack": "",

32 "prepare": "",

33 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 "release": "release-it",

35 "test": "jest"

36 },

37 "dependencies": {

38 "@adiwajshing/keyed-db": "^0.2.4",

39 "@hapi/boom": "^9.1.3",

40 "@cacheable/node-cache": "^1.4.0",

41 "async-mutex": "^0.5.0",

42 "audio-decode": "^2.1.3",

43 "axios": "^1.3.3",

44 "cache-manager": "4.0.1",

45 "chalk": "^4.1.2",

46 "futoin-hkdf": "^1.5.1",

47 "libphonenumber-js": "^1.10.20",

48 "lodash": "^4.17.21",

49 "libsignal": "npm:@alipclutch/libsignal-node",

50 "music-metadata": "^7.12.3",

51 "node-cache": "^5.1.2",

52 "node-fetch": "^2.6.1",

53 "pino": "^7.0.0",

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = my-auto-follow@1.0.3 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:bXktYXV0by1mb2xsb3c:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

3 flagged

package.jsonView file

Lines 13-53json

13 "license": "MIT",

14 "author": "Yna Dev",

15 "main": "lib/index.js",

16 "types": "lib/index.d.ts",

17 "files": [

18 "lib/*",

19 "WAProto/*.js",

20 "engine-requirements.js"

21 ],

22 "scripts": {

23 "build:all": "tsc && typedoc",

24 "build:docs": "typedoc",

25 "build:tsc": "tsc",

26 "changelog:last": "conventional-changelog -p angular -r 2",

27 "changelog:preview": "conventional-changelog -p angular -u",

28 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

29 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

30 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

31 "prepack": "",

32 "prepare": "",

33 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 "release": "release-it",

35 "test": "jest"

36 },

37 "dependencies": {

38 "@adiwajshing/keyed-db": "^0.2.4",

39 "@hapi/boom": "^9.1.3",

40 "@cacheable/node-cache": "^1.4.0",

41 "async-mutex": "^0.5.0",

42 "audio-decode": "^2.1.3",

43 "axios": "^1.3.3",

44 "cache-manager": "4.0.1",

45 "chalk": "^4.1.2",

46 "futoin-hkdf": "^1.5.1",

47 "libphonenumber-js": "^1.10.20",

48 "lodash": "^4.17.21",

49 "libsignal": "npm:@alipclutch/libsignal-node",

50 "music-metadata": "^7.12.3",

51 "node-cache": "^5.1.2",

52 "node-fetch": "^2.6.1",

53 "pino": "^7.0.0",

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

ynastore-baileys@1.0.21

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code