zero-baileys: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

zero-baileys: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall =

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall =

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/VoIP/worker-bootstrap.jsView file

346const code = fs.readFileSync(url, "utf8"); L347: eval(code); L348: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/VoIP/worker-bootstrap.jsView on unpkg · L346

lib/VoIP/wasm-engine.jsView file

14const __filename = __filename; L15: const __dirname = __dirname; L16: L17: const CALL_WASM_AB_PROPS_JSON = process.env.CALL_WASM_AB_PROPS_JSON ?? ""; L18: const PTHREAD_POOL_SIZE = 20; ... L23: try { L24: const parsed = JSON.parse(raw); L25: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed; ... L43: L44: const filterWorkerStderr = (chunk) => { L45: const line = chunk.toString().trim(); L46: if (line && !line.startsWith("voip:") && !line.startsWith("still waiting")) {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/VoIP/wasm-engine.jsView on unpkg · L14

lib/assets/wasm/whatsapp.wasmView file

•path = lib/assets/wasm/whatsapp.wasm kind = wasm_module sizeBytes = 9819554 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/assets/wasm/whatsapp.wasmView on unpkg

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 301 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Socket/messages-send.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zero-baileys@2.7.0 matchedIdentity = npm:emVyby1iYWlsZXlz:2.7.0 similarity = 0.974 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Socket/messages-send.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 14-54json

14 "main": "lib/index.js",

15 "types": "lib/index.d.ts",

16 "files": [

17 "lib/**/*",

18 "WAProto/**/*",

19 "engine-requirements.js",

20 "README.md",

21 "LICENSE"

22 ],

23 "scripts": {

24 "build:all": "tsc && typedoc",

25 "build:docs": "typedoc",

26 "build:tsc": "tsc",

27 "changelog:last": "conventional-changelog -p angular -r 2",

28 "changelog:preview": "conventional-changelog -p angular -u",

29 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

30 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

31 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

32 "prepack": "",

33 "prepare": "",

34 "preinstall": "",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L34

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L34

35 "release": "release-it",

36 "test": "jest"

37 },

38 "dependencies": {

39 "@adiwajshing/keyed-db": "^0.2.4",

40 "@cacheable/node-cache": "^1.4.0",

41 "@hapi/boom": "^9.1.3",

42 "@hapi/hoek": "^11.0.7",

43 "async-mutex": "^0.5.0",

44 "audio-decode": "^2.1.3",

45 "axios": "^1.3.3",

46 "cache-manager": "4.0.1",

47 "chalk": "^4.1.2",

48 "fflate": "^0.8.2",

49 "futoin-hkdf": "^1.5.1",

50 "libphonenumber-js": "^1.10.20",

51 "libsignal": "npm:@otaxayun/libsignal-node@latest",

52 "lodash": "^4.17.21",

53 "music-metadata": "^7.12.3",

54 "node-cache": "^5.1.2",

lib/VoIP/worker-bootstrap.jsView file

Lines 326-366javascript

326__modules["Promise"] = { exports: Promise };

327const bxFunc = function (id) { return id; };

328bxFunc.getURL = function

lib/VoIP/wasm-engine.jsView file

Lines 1-34javascript

1'use strict';

2

3/**

4 * WhatsApp VoIP WASM engine.

5 * Converted to CJS.

6 */

7

8const vm = require("node:vm");

9const

lib/assets/wasm/whatsapp.wasmView file

•path = lib/assets/wasm/whatsapp.wasm kind = wasm_module sizeBytes = 9819554 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/assets/wasm/whatsapp.wasmView on unpkg

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 301 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Socket/messages-send.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zero-baileys@2.7.0 matchedIdentity = npm:emVyby1iYWlsZXlz:2.7.0 similarity = 0.974 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Socket/messages-send.jsView on unpkg