Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@skidy89/baileys
Advanced tools
This library was originally a project for CS-2362 at Ashoka University and is in no way affiliated with or endorsed by WhatsApp. Use at your own discretion. Do not spam people with this. We discourage any stalkerware, bulk or automated messaging usage.
Baileys and its maintainers cannot be held liable for misuse of this application, as stated in the MIT license. The maintainers of Baileys do not in any way condone the use of this application in practices that violate the Terms of Service of WhatsApp. The maintainers of this application call upon the personal responsibility of its users to use this application in a fair way, as it is intended to be used.
[!IMPORTANT] The original repository had to be removed by the original author - we now continue development in this repository here. This is the only official repository and is maintained by the community. Join the Discord here
Do check out & run example.ts to see an example usage of the library. The script covers most common use cases. To run the example script, download or clone the repo and then type the following in a terminal:
cd path/to/Baileys
yarn
yarn example
Use the stable version:
yarn add @whiskeysockets/baileys
Use the edge version (no guarantee of stability, but latest fixes + features)
yarn add github:WhiskeySockets/Baileys
Then import your code using:
import makeWASocket from '@whiskeysockets/baileys'
WhatsApp provides a multi-device API that allows Baileys to be authenticated as a second WhatsApp client by scanning a QR code or Pairing Code with WhatsApp on your phone.
[!NOTE] Here is a simple example of event handling
[!TIP] You can see all supported socket configs here (Recommended)
[!TIP] You can customize browser name if you connect with QR-CODE, with
Browser
constant, we have some browsers config, see here
import makeWASocket from '@whiskeysockets/baileys'
const sock = makeWASocket({
// can provide additional config here
browser: Browsers.ubuntu('My App'),
printQRInTerminal: true
})
If the connection is successful, you will see a QR code printed on your terminal screen, scan it with WhatsApp on your phone and you'll be logged in!
[!IMPORTANT] Pairing Code isn't Mobile API, it's a method to connect Whatsapp Web without QR-CODE, you can connect only with one device, see here
The phone number can't have +
or ()
or -
, only numbers, you must provide country code
import makeWASocket from '@whiskeysockets/baileys'
const sock = makeWASocket({
// can provide additional config here
printQRInTerminal: false //need to be false
})
if (!sock.authState.creds.registered) {
const number = 'XXXXXXXXXXX'
const code = await sock.requestPairingCode(number)
console.log(code)
}
syncFullHistory
as true
const sock = makeWASocket({
...otherOpts,
// can use Windows, Ubuntu here too
browser: Browsers.macOS('Desktop'),
syncFullHistory: true
})
If you use baileys for groups, we recommend you to set cachedGroupMetadata
in socket config, you need to implement a cache like this:
const groupCache = new NodeCache({stdTTL: 5 * 60, useClones: false})
const sock = makeWASocket({
cachedGroupMetadata: async (jid) => groupCache.get(jid)
})
sock.ev.on('groups.update', async ([event]) => {
const metadata = await sock.groupMetadata(event.id)
groupCache.set(event.id, metadata)
})
sock.ev.on('group-participants.update', async (event) => {
const metadata = await sock.groupMetadata(event.id)
groupCache.set(event.id, metadata)
})
getMessage
config in socket like this:
const sock = makeWASocket({
getMessage: async (key) => await getMessageFromStore(key)
})
markOnlineOnConnect
to false
const sock = makeWASocket({
markOnlineOnConnect: false
})
You obviously don't want to keep scanning the QR code every time you want to connect.
So, you can load the credentials to log back in:
import makeWASocket, { useMultiFileAuthState } from '@whiskeysockets/baileys'
const { state, saveCreds } = await useMultiFileAuthState('auth_info_baileys')
// will use the given state to connect
// so if valid credentials are available -- it'll connect without QR
const sock = makeWASocket({ auth: state })
// this will be called as soon as the credentials are updated
sock.ev.on('creds.update', saveCreds)
[!IMPORTANT]
useMultiFileAuthState
is a utility function to help save the auth state in a single folder, this function serves as a good guide to help write auth & key states for SQL/no-SQL databases, which I would recommend in any production grade system.
[!NOTE] When a message is received/sent, due to signal sessions needing updating, the auth keys (
authState.keys
) will update. Whenever that happens, you must save the updated keys (authState.keys.set()
is called). Not doing so will prevent your messages from reaching the recipient & cause other unexpected consequences. TheuseMultiFileAuthState
function automatically takes care of that, but for any other serious implementation -- you will need to be very careful with the key state management.
[!IMPORTANT] The events are these, it's important you see all events
You can listen to these events like this:
const sock = makeWASocket()
sock.ev.on('messages.upsert', ({ messages }) => {
console.log('got messages', messages)
})
[!NOTE] This example includes basic auth storage too
import makeWASocket, { DisconnectReason, useMultiFileAuthState } from '@whiskeysockets/baileys'
import { Boom } from '@hapi/boom'
async function connectToWhatsApp () {
const { state, saveCreds } = await useMultiFileAuthState('auth_info_baileys')
const sock = makeWASocket({
// can provide additional config here
auth: state,
printQRInTerminal: true
})
sock.ev.on('connection.update', (update) => {
const { connection, lastDisconnect } = update
if(connection === 'close') {
const shouldReconnect = (lastDisconnect.error as Boom)?.output?.statusCode !== DisconnectReason.loggedOut
console.log('connection closed due to ', lastDisconnect.error, ', reconnecting ', shouldReconnect)
// reconnect if not logged out
if(shouldReconnect) {
connectToWhatsApp()
}
} else if(connection === 'open') {
console.log('opened connection')
}
})
sock.ev.on('messages.upsert', event => {
for (const m of event.messages) {
console.log(JSON.stringify(m, undefined, 2))
console.log('replying to', m.key.remoteJid)
await sock.sendMessage(m.key.remoteJid!, { text: 'Hello Word' })
}
})
// to storage creds (session info) when it updates
sock.ev.on('creds.update', saveCreds)
}
// run in main file
connectToWhatsApp()
[!IMPORTANT] In
messages.upsert
it's recommended to use a loop likefor (const message of event.messages)
to handle all messages in array
messages.update
sock.ev.on('messages.update', event => {
for(const { key, update } of event) {
if(update.pollUpdates) {
const pollCreation = await getMessage(key)
if(pollCreation) {
console.log(
'got poll update, aggregation: ',
getAggregateVotesInPollMessage({
message: pollCreation,
pollUpdates: update.pollUpdates,
})
)
}
}
}
})
getMessage
is a store implementation (in your end)connection.update
will be fired requesting you to restart sockmessaging.history-set
[!IMPORTANT] I highly recommend building your own data store, as storing someone's entire chat history in memory is a terrible waste of RAM.
It can be used as follows:
import makeWASocket, { makeInMemoryStore } from '@whiskeysockets/baileys'
// the store maintains the data of the WA connection in memory
// can be written out to a file & read from it
const store = makeInMemoryStore({ })
// can be read from a file
store.readFromFile('./baileys_store.json')
// saves the state to a file every 10s
setInterval(() => {
store.writeToFile('./baileys_store.json')
}, 10_000)
const sock = makeWASocket({ })
// will listen from this socket
// the store can listen from a new socket once the current socket outlives its lifetime
store.bind(sock.ev)
sock.ev.on('chats.upsert', () => {
// can use 'store.chats' however you want, even after the socket dies out
// 'chats' => a KeyedDB instance
console.log('got chats', store.chats.all())
})
sock.ev.on('contacts.upsert', () => {
console.log('got contacts', Object.values(store.contacts))
})
The store also provides some simple functions such as loadMessages
that utilize the store to speed up data retrieval.
id
is the WhatsApp ID, called jid
too, of the person or group you're sending the message to.
[country code][phone number]@s.whatsapp.net
- Example for people: +19999999999@s.whatsapp.net
.
- For groups, it must be in the format 123456789-123345@g.us
.[timestamp of creation]@broadcast
.status@broadcast
.getContentType
, returns the content type for any messagegetDevice
, returns the device from messagemakeCacheableSignalKeyStore
, make auth store more fastdownloadContentFromMessage
, download content from any messageSend all types of messages with a single function
const jid: string
const content: AnyMessageContent
const options: MiscMessageGenerationOptions
sock.sendMessage(jid, content, options)
await sock.sendMessage(jid, { text: 'hello word' })
await sock.sendMessage(jid, { text: 'hello word' }, { quoted: message })
await sock.sendMessage(
jid,
{
text: '@
FAQs
WhatsApp API
We found that @skidy89/baileys demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.