registry / zero-baileys / 2.6.0

zero-baileys@2.6.0

WhatsApp API - NEW APDETE BAILEYS ZEROZ Edition

AI Security Review

scanned 28d ago · by lpm-firewall-ai

A caller that supplies a shell-metacharacter-bearing video file path can cause shell command injection during thumbnail generation. This occurs at runtime, not during installation.

Static reason

One or more suspicious static signals were detected.

Trigger

Calling generateThumbnail with mediaType set to video and an attacker-controlled file path.

Impact

Arbitrary commands can run with the host application's privileges.

Mechanism

Unquoted path interpolation into child_process.exec.

AI rationale

The package does not show install-time malicious behavior, but it contains a concrete runtime command-injection vulnerability in an exported media-processing path. This warrants a warning rather than a publish block for malware.

Evidence

lib/Utils/messages-media.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The video-thumbnail helper interpolates its path arguments into a shell command passed to exec.
The exported thumbnail routine forwards its file argument to that unsafe helper.
Installation runs a local Node-version check.

zero-baileys@2.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code