A WebSockets library for interacting with WhatsApp Web
62%
Total Score
caution
Usable with caveats: a prerelease and workflow hygiene issues keep this release below the healthy range.
Preinstall, prepack, and prepare scripts add installation and packaging execution paths that deserve review, although these scripts can also support normal builds.
Four active maintainers made five commits in the last three months, showing continued work but a relatively light recent development pace for a prerelease.
Issue and pull-request activity is ongoing, but no pull requests were merged in the last month while 40 remain open, indicating some delivery backlog.
The repository uses TypeScript, npm scripts, and esbuild, but no security-scanning tooling was detected; the separate SECURITY.md provides some compensating transparency.
This release is a prerelease and 70% of recent releases are prereleases, increasing compatibility risk for a dependency despite the stable major line.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-48063 baileys is vulnerable to Authentication Bypass by Spoofing in versions 0.0.0 - 6.7.22 and 7.0.0-rc.1 - 7.0.0-rc12. | 0.0.0 - 6.7.227.0.0-rc.1 - 7.0.0-rc12 | Critical |
| Dependency | Last Release | Score |
|---|---|---|
ws Version ^8.13.0 | — | — |
pino Version ^9.6 | — | — |
p-queue Version ^9.0.0 | — | — |
libsignal Version ^6.0.0 | — | — |
lru-cache Version ^11.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.