
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@kxa/xbails
Advanced tools
Affected versions:
WhatsApp Baileys Library Modification to make it easier for developers to develop for anything
🚀 @kxa/xbails
High Performance WhatsApp Library powered by Rust WASM
Enhanced Baileys fork with Anti-Ban, Meta AI, MEX GraphQL, Interop, and WA-Web Protocol support.
📦 Package Information
Property| Value 📦 Package| "@kxa/xbails" 🏷️ Version| "0.0.5" 💬 Telegram| t.me/setorankxa ⚡ Runtime| Node.js 23+ 🦀 Engine| Rust WASM Bridge 🔗 Base| Baileys Fork
📚 Table of Contents
Getting Started
Authentication
Core Features
Anti-Ban Suite
Messaging
Advanced Features
Internal Protocols
Utilities
Rust WASM Bridge
✨ What's Different?
🦀 Rust WASM Performance
Component| Upstream Baileys| WBails Binary Decode| JavaScript| Rust WASM Noise Handshake| JavaScript| Rust WASM AES / HMAC / HKDF| Node Crypto| Rust WASM Signal Protocol| libsignal-node| Rust WASM
Benefits
🔥 Feature Highlights
Feature| Description 🤖 Meta AI| Full Meta AI integration and message handling 🔐 MEX GraphQL| Direct access to WhatsApp internal GraphQL APIs 🛡️ Anti-Ban Suite| Multiple protection layers for account safety 🌐 Interoperability| Facebook & Instagram messaging support 📦 Album Messages| Send multiple media in one message 🎨 Sticker Packs| Native sticker pack support 📢 Newsletters| Newsletter invite & follower messages 🏘️ Communities| Community and subgroup management 📞 Call Signalling| Advanced call event support 🌍 WA-Web Port| Mobile and Web protocol parity
📥 Installation
npm install npm:@kxa/xbails
Requirements
Node.js >= 23 npm >= 10
Optional Dependencies
Package| Purpose sharp| Image processing jimp| Fallback image processing audio-decode| Voice metadata extraction link-preview-js| Link preview generation
npm install sharp jimp audio-decode link-preview-js
🦀 Rust WASM Bridge
The Baileys uses whatsapp-rust-bridge compiled to WebAssembly (WASM).
Unlike native ".node" addons, WASM runs on:
No Rust compiler is required for normal installations.
The package ships with a prebuilt ".wasm" binary, allowing it to run immediately after installation.
🔬 MEX — WhatsApp Internal GraphQL
MEX powers many modern WhatsApp features:
Example:
await sock.setPrivacySetting('LAST_SEEN', 'CONTACTS')
const user = await sock.findUserByUsername('@lendd3')
const abouts = await sock.getTextStatusList([ '1@s.whatsapp.net' ])
📖 Full documentation: "documentation/MEX.md"
📖 Documentation
Topic| Documentation MEX GraphQL| "documentation/MEX.md" USync| "documentation/USYNC.md" HTTPS GraphQL| "documentation/GRAPHQL.md" Privacy & Profile| "documentation/PRIVACY.md" Registration| "documentation/REGISTRATION.md" Managed Accounts| "documentation/MANAGED-ACCOUNT.md" Communities| "documentation/COMMUNITIES.md" Interoperability| "documentation/INTEROP.md" Username System| "documentation/USERNAME.md" Anti-Ban| "documentation/ANTIBAN.md" Ban System| "documentation/BAN-SYSTEM.md" Protocol Reference| "documentation/PROTOCOLS.md" WA-Web Port| "documentation/WA-WEB-PORT.md"
Created By Kxa
FAQs
security holding package
The npm package @kxa/xbails receives a total of 74 weekly downloads. As such, @kxa/xbails popularity was classified as not popular.
We found that @kxa/xbails demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.