Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@brunocgc/baileys
Advanced tools
This library was originally a project for CS-2362 at Ashoka University and is in no way affiliated with or endorsed by WhatsApp. Use at your own discretion. Do not spam people with this. We discourage any stalkerware, bulk or automated messaging usage.
Baileys and its maintainers cannot be held liable for misuse of this application, as stated in the MIT license. The maintainers of Baileys do not in any way condone the use of this application in practices that violate the Terms of Service of WhatsApp. The maintainers of this application call upon the personal responsibility of its users to use this application in a fair way, as it is intended to be used.
[!IMPORTANT] The original repository had to be removed by the original author - we now continue development in this repository here. This is the only official repository and is maintained by the community. Join the Discord here
Do check out & run example.ts to see an example usage of the library. The script covers most common use cases. To run the example script, download or clone the repo and then type the following in a terminal:
cd path/to/Baileys
yarn
yarn example
Use the stable version:
yarn add @brunocgc/baileys
Use the edge version (no guarantee of stability, but latest fixes + features)
yarn add github:brunocgc/Baileys
Then import your code using:
import makeWASocket from '@brunocgc/baileys'
WhatsApp provides a multi-device API that allows Baileys to be authenticated as a second WhatsApp client by scanning a QR code or Pairing Code with WhatsApp on your phone.
[!NOTE] Here is a simple example of event handling
[!TIP] You can see all supported socket configs here (Recommended)
[!TIP] You can customize browser name if you connect with QR-CODE, with
Browser
constant, we have some browsers config, see here
import makeWASocket from '@brunocgc/baileys'
const sock = makeWASocket({
// can provide additional config here
browser: Browsers.ubuntu('My App'),
printQRInTerminal: true
})
If the connection is successful, you will see a QR code printed on your terminal screen, scan it with WhatsApp on your phone and you'll be logged in!
[!IMPORTANT] Pairing Code isn't Mobile API, it's a method to connect Whatsapp Web without QR-CODE, you can connect only with one device, see here
The phone number can't have +
or ()
or -
, only numbers, you must provide country code
import makeWASocket from '@brunocgc/baileys'
const sock = makeWASocket({
// can provide additional config here
printQRInTerminal: false //need to be false
})
if (!sock.authState.creds.registered) {
const number = 'XXXXXXXXXXX'
const code = await sock.requestPairingCode(number)
console.log(code)
}
syncFullHistory
as true
const sock = makeWASocket({
...otherOpts,
// can use Windows, Ubuntu here too
browser: Browsers.macOS('Desktop'),
syncFullHistory: true
})
If you use baileys for groups, we recommend you to set cachedGroupMetadata
in socket config, you need to implement a cache like this:
const groupCache = new NodeCache({stdTTL: 5 * 60, useClones: false})
const sock = makeWASocket({
cachedGroupMetadata: async (jid) => groupCache.get(jid)
})
sock.ev.on('groups.update', async ([event]) => {
const metadata = await sock.groupMetadata(event.id)
groupCache.set(event.id, metadata)
})
sock.ev.on('group-participants.update', async (event) => {
const metadata = await sock.groupMetadata(event.id)
groupCache.set(event.id, metadata)
})
getMessage
config in socket like this:
const sock = makeWASocket({
getMessage: async (key) => await getMessageFromStore(key)
})
markOnlineOnConnect
to false
const sock = makeWASocket({
markOnlineOnConnect: false
})
You obviously don't want to keep scanning the QR code every time you want to connect.
So, you can load the credentials to log back in:
import makeWASocket, { BufferJSON, useMultiFileAuthState } from '@brunocgc/baileys'
const { state, saveCreds } = await useMultiFileAuthState('auth_info_baileys')
// will use the given state to connect
// so if valid credentials are available -- it'll connect without QR
const sock = makeWASocket({ auth: state })
// this will be called as soon as the credentials are updated
sock.ev.on('creds.update', saveCreds)
[!IMPORTANT]
useMultiFileAuthState
is a utility function to help save the auth state in a single folder, this function serves as a good guide to help write auth & key states for SQL/no-SQL databases, which I would recommend in any production grade system.
[!NOTE] When a message is received/sent, due to signal sessions needing updating, the auth keys (
authState.keys
) will update. Whenever that happens, you must save the updated keys (authState.keys.set()
is called). Not doing so will prevent your messages from reaching the recipient & cause other unexpected consequences. TheuseMultiFileAuthState
function automatically takes care of that, but for any other serious implementation -- you will need to be very careful with the key state management.
[!IMPORTANT] The events are these, it's important you see all events
You can listen to these events like this:
const sock = makeWASocket()
sock.ev.on('messages.upsert', ({ messages }) => {
console.log('got messages', messages)
})
import makeWASocket, { DisconnectReason, useMultiFileAuthState } from '@brunocgc/baileys'
import { Boom } from '@hapi/boom'
async function connectToWhatsApp () {
const sock = makeWASocket({
// can provide additional config here
printQRInTerminal: true
})
sock.ev.on('connection.update', (update) => {
const { state, saveCreds } = await useMultiFileAuthState('auth_info_baileys')
const { connection, lastDisconnect } = update
if(connection === 'close') {
const shouldReconnect = (lastDisconnect.error as Boom)?.output?.statusCode !== DisconnectReason.loggedOut
console.log('connection closed due to ', lastDisconnect.error, ', reconnecting ', shouldReconnect)
// reconnect if not logged out
if(shouldReconnect) {
connectToWhatsApp()
}
} else if(connection === 'open') {
console.log('opened connection')
}
})
sock.ev.on('messages.upsert', event => {
for (const m of event.messages) {
console.log(JSON.stringify(m, undefined, 2))
console.log('replying to', m.key.remoteJid)
await sock.sendMessage(m.key.remoteJid!, { text: 'Hello Word' })
}
})
// to storage creds (session info) when it updates
sock.ev.on('creds.update', saveCreds)
}
// run in main file
connectToWhatsApp()
[!IMPORTANT] In
messages.upsert
it's recommended to use a loop likefor (const message of event.messages)
to handle all messages in array
messages.update
sock.ev.on('messages.update', event => {
for(const { key, update } of event) {
if(update.pollUpdates) {
const pollCreation = await getMessage(key)
if(pollCreation) {
console.log(
'got poll update, aggregation: ',
getAggregateVotesInPollMessage({
message: pollCreation,
pollUpdates: update.pollUpdates,
})
)
}
}
}
})
getMessage
is a store implementation (in your end)connection.update
will be fired requesting you to restart sockmessaging.history-set
[!IMPORTANT] I highly recommend building your own data store, as storing someone's entire chat history in memory is a terrible waste of RAM.
It can be used as follows:
import makeWASocket, { makeInMemoryStore } from '@brunocgc/baileys'
// the store maintains the data of the WA connection in memory
// can be written out to a file & read from it
const store = makeInMemoryStore({ })
// can be read from a file
store.readFromFile('./baileys_store.json')
// saves the state to a file every 10s
setInterval(() => {
store.writeToFile('./baileys_store.json')
}, 10_000)
const sock = makeWASocket({ })
// will listen from this socket
// the store can listen from a new socket once the current socket outlives its lifetime
store.bind(sock.ev)
sock.ev.on('chats.upsert', () => {
// can use 'store.chats' however you want, even after the socket dies out
// 'chats' => a KeyedDB instance
console.log('got chats', store.chats.all())
})
sock.ev.on('contacts.upsert', () => {
console.log('got contacts', Object.values(store.contacts))
})
The store also provides some simple functions such as loadMessages
that utilize the store to speed up data retrieval.
id
is the WhatsApp ID, called jid
too, of the person or group you're sending the message to.
[country code][phone number]@s.whatsapp.net
+19999999999@s.whatsapp.net
.123456789-123345@g.us
.[timestamp of creation]@broadcast
.status@broadcast
.getContentType
, returns the content type for any messagegetDevice
, returns the device from messagemakeCacheableSignalKeyStore
, make auth store more fastdownloadContentFromMessage
, download content from any messageSend all types of messages with a single function
const jid: string
const content: AnyMessageContent
const options: MiscMessageGenerationOptions
sock.sendMessage(jid, content, options)
await sock.sendMessage(jid, { text: 'hello word' })
await sock.sendMessage(jid, { text: 'hello word' }, { quoted: message })
await sock.sendMessage(
jid,
{
text: '@12345678901',
mentions: ['12345678901@s.whatsapp.net']
}
)
const msg = getMessageFromStore() // implement this on your end
await sock.sendMessage(jid, { forward: msg }) // WA forward the message!
await sock.sendMessage(
jid,
{
location: {
degreesLatitude: 24.121231,
degreesLongitude: 55.1121221
}
}
)
const vcard = 'BEGIN:VCARD\n' // metadata of the contact card
+ 'VERSION:3.0\n'
+ 'FN:Jeff Singh\n' // full name
+ 'ORG:Ashoka Uni;\n' // the organization of the contact
+ 'TEL;type=CELL;type=VOICE;waid=911234567890:+91 12345 67890\n' // WhatsApp ID + phone number
+ 'END:VCARD'
await sock.sendMessage(
id,
{
contacts: {
displayName: 'Jeff',
contacts: [{ vcard }]
}
}
)
await sock.sendMessage(
jid,
{
react: {
text: '💖', // use an empty string to remove the reaction
key: message.key
}
}
)
Time | Seconds |
---|---|
24h | 86.400 |
7d | 604.800 |
30d | 2.592.000 |
await sock.sendMessage(
jid,
{
pin: {
type: 1, // 0 to remove
time: 86400
key: message.key
}
}
)
await sock.sendMessage(
jid,
{
poll: {
name: 'My Poll',
values: ['Option 1', 'Option 2', ...],
selectableCount: 1,
toAnnouncementGroup: false // or true
}
}
)
link-preview-js
as a dependency to your project with yarn add link-preview-js
await sock.sendMessage(
jid,
{
text: 'Hi, this was sent using https://github.com/brunocgc/baileys'
}
)
Sending media (video, stickers, images) is easier & more efficient than ever.
[!NOTE] In media messages, you can pass
{ stream: Stream }
or{ url: Url }
orBuffer
directly, you can see more here
[!TIP] It's recommended to use Stream or Url to save memory
.gif
files, that's why we send gifs as common .mp4
video with gifPlayback
flagawait sock.sendMessage(
jid,
{
video: fs.readFileSync('Media/ma_gif.mp4'),
caption: 'hello word',
gifPlayback: true
}
)
await sock.sendMessage(
id,
{
video: {
url: './Media/ma_gif.mp4'
},
caption: 'hello word',
ptv: false // if set to true, will send as a `video note`
}
)
ffmpeg
with this flags:
codec: libopus //ogg file
ac: 1 //one channel
avoid_negative_ts
make_zero
ffmpeg -i input.mp4 -avoid_negative_ts make_zero -ac 1 output.ogg
await sock.sendMessage(
jid,
{
audio: {
url: './Media/audio.mp3'
},
mimetype: 'audio/mp4'
}
)
await sock.sendMessage(
id,
{
image: {
url: './Media/ma_img.png'
},
caption: 'hello word'
}
)
viewOnce
, you only need to pass viewOnce: true
in content objectawait sock.sendMessage(
id,
{
image: {
url: './Media/ma_img.png'
},
viewOnce: true, //works with video, audio too
caption: 'hello word'
}
)
const msg = await sock.sendMessage(jid, { text: 'hello word' })
await sock.sendMessage(jid, { delete: msg.key })
Note: deleting for oneself is supported via chatModify
, see in this section
await sock.sendMessage(jid, {
text: 'updated text goes here',
edit: response.key,
});
jimp
or sharp
as a dependency in your project using yarn add jimp
or yarn add sharp
.ffmpeg
installed on your system.If you want to save the media you received
import { createWriteStream } from 'fs'
import { downloadMediaMessage, getContentType } from '@brunocgc/baileys'
sock.ev.on('messages.upsert', async ({ [m] }) => {
if (!m.message) return // if there is no text or media message
const messageType = getContentType(m) // get what type of message it is (text, image, video...)
// if the message is an image
if (messageType === 'imageMessage') {
// download the message
const stream = await downloadMediaMessage(
m,
'stream', // can be 'buffer' too
{ },
{
logger,
// pass this so that baileys can request a reupload of media
// that has been deleted
reuploadRequest: sock.updateMediaMessage
}
)
// save to file
const writeStream = createWriteStream('./my-download.jpeg')
stream.pipe(writeStream)
}
}
await sock.updateMediaMessage(msg)
await sock.offerCall(jid, isVideo)
callId
and callFrom
from call
eventawait sock.terminateCall(callId, callFrom)
callId
and callFrom
from call
eventawait sock.rejectCall(callId, callFrom)
const key: WAMessageKey
// can pass multiple keys to read multiple messages as well
await sock.readMessages([key])
The message ID is the unique identifier of the message that you are marking as read.
On a WAMessage
, the messageID
can be accessed using messageID = message.key.id
.
presence
can be one of thesejid
know whether you're online, offline, typing etc.await sock.sendPresenceUpdate('available', jid)
[!NOTE] If a desktop client is active, WA doesn't send push notifications to the device. If you would like to receive said notifications -- mark your Baileys client offline using
sock.sendPresenceUpdate('unavailable')
WA uses an encrypted form of communication to send chat/app updates. This has been implemented mostly and you can send the following updates:
[!IMPORTANT] If you mess up one of your updates, WA can log you out of all your devices and you'll have to log in again.
const lastMsgInChat = await getLastMessageInChat(jid) // implement this on your end
await sock.chatModify({ archive: true, lastMessages: [lastMsgInChat] }, jid)
Time | Miliseconds |
---|---|
Remove | null |
8h | 86.400.000 |
7d | 604.800.000 |
// mute for 8 hours
await sock.chatModify({ mute: 8 * 60 * 60 * 1000 }, jid)
// unmute
await sock.chatModify({ mute: null }, jid)
const lastMsgInChat = await getLastMessageInChat(jid) // implement this on your end
// mark it unread
await sock.chatModify({ markRead: false, lastMessages: [lastMsgInChat] }, jid)
await sock.chatModify(
{
clear: {
messages: [
{
id: 'ATWYHDNNWU81732J',
fromMe: true,
timestamp: '1654823909'
}
]
}
},
jid
)
const lastMsgInChat = await getLastMessageInChat(jid) // implement this on your end
await sock.chatModify({
delete: true,
lastMessages: [
{
key: lastMsgInChat.key,
messageTimestamp: lastMsgInChat.messageTimestamp
}
]
},
jid
)
await sock.chatModify({
pin: true // or `false` to unpin
},
jid
)
await sock.chatModify({
star: {
messages: [
{
id: 'messageID',
fromMe: true // or `false`
}
],
star: true // - true: Star Message; false: Unstar Message
}
},
jid
)
Time | Seconds |
---|---|
Remove | 0 |
24h | 86.400 |
7d | 604.800 |
90d | 7.776.000 |
// turn on disappearing messages
await sock.sendMessage(
jid,
// this is 1 week in seconds -- how long you want messages to appear for
{ disappearingMessagesInChat: WA_DEFAULT_EPHEMERAL }
)
// will send as a disappearing message
await sock.sendMessage(jid, { text: 'hello' }, { ephemeralExpiration: WA_DEFAULT_EPHEMERAL })
// turn off disappearing messages
await sock.sendMessage(
jid,
{ disappearingMessagesInChat: false }
)
const [result] = await sock.onWhatsApp(jid)
if (result.exists) console.log (`${jid} exists on WhatsApp, as jid: ${result.jid}`)
const msg = await getOldestMessageInChat(jid)
await sock.fetchMessageHistory(
50, //quantity (max: 50 per query)
msg.key,
msg.messageTimestamp
)
messaging.history-set
eventconst status = await sock.fetchStatus(jid)
console.log('status: ' + status)
// for low res picture
const ppUrl = await sock.profilePictureUrl(jid)
console.log(ppUrl)
// for high res picture
const ppUrl = await sock.profilePictureUrl(jid, 'image')
const profile = await sock.getBusinessProfile(jid)
console.log('business description: ' + profile.description + ', category: ' + profile.category)
// the presence update is fetched and called here
sock.ev.on('presence.update', console.log)
// request updates for a chat
await sock.presenceSubscribe(jid)
await sock.updateProfileStatus('Hello World!')
await sock.updateProfileName('My name')
[!NOTE] Like media messages, you can pass
{ stream: Stream }
or{ url: Url }
orBuffer
directly, you can see more here
await sock.updateProfilePicture(jid, { url: './new-profile-picture.jpeg' })
await sock.removeProfilePicture(jid)
// title & participants
const group = await sock.groupCreate('My Fab Group', ['1234@s.whatsapp.net', '4564@s.whatsapp.net'])
console.log('created group with id: ' + group.gid)
await sock.sendMessage(group.id, { text: 'hello there' }) // say hello to everyone on the group
// id & people to add to the group (will throw error if it fails)
await sock.groupParticipantsUpdate(
jid,
['abcd@s.whatsapp.net', 'efgh@s.whatsapp.net'],
'add' // replace this parameter with 'remove' or 'demote' or 'promote'
)
await sock.groupUpdateSubject(jid, 'New Subject!')
await sock.groupUpdateDescription(jid, 'New Description!')
// only allow admins to send messages
await sock.groupSettingUpdate(jid, 'announcement')
// allow everyone to send messages
await sock.groupSettingUpdate(jid, 'not_announcement')
// allow everyone to modify the group's settings -- like display picture etc.
await sock.groupSettingUpdate(jid, 'unlocked')
// only allow admins to modify the group's settings
await sock.groupSettingUpdate(jid, 'locked')
// will throw error if it fails
await sock.groupLeave(jid)
'https://chat.whatsapp.com/' + code
const code = await sock.groupInviteCode(jid)
console.log('group code: ' + code)
const code = await sock.groupRevokeInvite(jid)
console.log('New group code: ' + code)
https://chat.whatsapp.com/
, only codeconst response = await sock.groupAcceptInvite(code)
console.log('joined to: ' + response)
const response = await sock.groupGetInviteInfo(code)
console.log('group information: ' + response)
const metadata = await sock.groupMetadata(jid)
console.log(metadata.id + ', title: ' + metadata.subject + ', description: ' + metadata.desc)
groupInviteMessage
const response = await sock.groupAcceptInviteV4(jid, groupInviteMessage)
console.log('joined to: ' + response)
const response = await sock.groupRequestParticipantsList(jid)
console.log(response)
const response = await sock.groupRequestParticipantsUpdate(
jid, // group id
['abcd@s.whatsapp.net', 'efgh@s.whatsapp.net'],
'approve' // or 'reject'
)
console.log(response)
const response = await sock.groupFetchAllParticipating()
console.log(response)
Time | Seconds |
---|---|
Remove | 0 |
24h | 86.400 |
7d | 604.800 |
90d | 7.776.000 |
await sock.groupToggleEphemeral(jid, 86400)
await sock.groupMemberAddMode(
jid,
'all_member_add' // or 'admin_add'
)
await sock.updateBlockStatus(jid, 'block') // Block user
await sock.updateBlockStatus(jid, 'unblock') // Unblock user
const privacySettings = await sock.fetchPrivacySettings(true)
console.log('privacy settings: ' + privacySettings)
const response = await sock.fetchBlocklist()
console.log(response)
const value = 'all' // 'contacts' | 'contact_blacklist' | 'none'
await sock.updateLastSeenPrivacy(value)
const value = 'all' // 'match_last_seen'
await sock.updateOnlinePrivacy(value)
const value = 'all' // 'contacts' | 'contact_blacklist' | 'none'
await sock.updateProfilePicturePrivacy(value)
const value = 'all' // 'contacts' | 'contact_blacklist' | 'none'
await sock.updateStatusPrivacy(value)
const value = 'all' // 'none'
await sock.updateReadReceiptsPrivacy(value)
const value = 'all' // 'contacts' | 'contact_blacklist'
await sock.updateGroupsAddPrivacy(value)
Time | Seconds |
---|---|
Remove | 0 |
24h | 86.400 |
7d | 604.800 |
90d | 7.776.000 |
const ephemeral = 86400
await sock.updateDefaultDisappearingMode(ephemeral)
await sock.sendMessage(
jid,
{
image: {
url: url
},
caption: caption
},
{
backgroundColor: backgroundColor,
font: font,
statusJidList: statusJidList,
broadcast: true
}
)
Message body can be a extendedTextMessage
or imageMessage
or videoMessage
or voiceMessage
, see here
You can add backgroundColor
and other options in the message options, see here
broadcast: true
enables broadcast mode
statusJidList
: a list of people that you can get which you need to provide, which are the people who will get this status message.
You can send messages to broadcast lists the same way you send messages to groups & individual chats.
Right now, WA Web does not support creating broadcast lists, but you can still delete them.
Broadcast IDs are in the format 12345678@broadcast
const bList = await sock.getBroadcastListInfo('1234@broadcast')
console.log (`list name: ${bList.name}, recps: ${bList.recipients}`)
Baileys is written with custom functionality in mind. Instead of forking the project & re-writing the internals, you can simply write your own extensions.
First, enable the logging of unhandled messages from WhatsApp by setting:
const sock = makeWASocket({
logger: P({ level: 'debug' }),
})
This will enable you to see all sorts of messages WhatsApp sends in the console.
[!TIP] If you want to learn whatsapp protocol, we recommend to study about Libsignal Protocol and Noise Protocol
{
"level": 10,
"fromMe": false,
"frame": {
"tag": "ib",
"attrs": {
"from": "@s.whatsapp.net"
},
"content": [
{
"tag": "edge_routing",
"attrs": {},
"content": [
{
"tag": "routing_info",
"attrs": {},
"content": {
"type": "Buffer",
"data": [8,2,8,5]
}
}
]
}
]
},
"msg":"communication"
}
The 'frame'
is what the message received is, it has three components:
tag
-- what this frame is about (eg. message will have 'message')attrs
-- a string key-value pair with some metadata (contains ID of the message usually)content
-- the actual data (eg. a message node will have the actual message content in it)[!TIP] Recommended to see
onMessageReceived
function insocket.ts
file to understand how websockets events are fired
// for any message with tag 'edge_routing'
sock.ws.on('CB:edge_routing', (node: BinaryNode) => { })
// for any message with tag 'edge_routing' and id attribute = abcd
sock.ws.on('CB:edge_routing,id:abcd', (node: BinaryNode) => { })
// for any message with tag 'edge_routing', id attribute = abcd & first content node routing_info
sock.ws.on('CB:edge_routing,id:abcd,routing_info', (node: BinaryNode) => { })
[!NOTE] Also, this repo is now licenced under GPL 3 since it uses libsignal-node
FAQs
WhatsApp API
We found that @brunocgc/baileys demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.