2026-02-25 21:04:36 -08:00
|
|
|
{
|
|
|
|
|
"name": "hermes-whatsapp-bridge",
|
|
|
|
|
"version": "1.0.0",
|
|
|
|
|
"description": "WhatsApp bridge for Hermes Agent using Baileys",
|
|
|
|
|
"private": true,
|
|
|
|
|
"type": "module",
|
|
|
|
|
"scripts": {
|
|
|
|
|
"start": "node bridge.js"
|
|
|
|
|
},
|
|
|
|
|
"dependencies": {
|
2026-04-14 14:23:37 -07:00
|
|
|
"@whiskeysockets/baileys": "WhiskeySockets/Baileys#01047debd81beb20da7b7779b08edcb06aa03770",
|
2026-02-25 21:04:36 -08:00
|
|
|
"express": "^4.21.0",
|
|
|
|
|
"qrcode-terminal": "^0.12.0",
|
|
|
|
|
"pino": "^9.0.0"
|
fix(whatsapp): pin protobufjs >=7.5.5 via npm overrides to clear 3 critical vulns (#19204)
The whatsapp-bridge pulls @whiskeysockets/baileys at a pinned git
commit whose transitive dep tree ships protobufjs <7.5.5, triggering
GHSA-xq3m-2v4x-88gg (critical, arbitrary code execution). npm audit
reported 3 cascading criticals: protobufjs, @whiskeysockets/libsignal-node
(pulls protobufjs), and baileys itself (effect rollup).
Fix: add npm overrides block pinning protobufjs to ^7.5.5. Deduplicates
to a single 7.5.6 copy at node_modules/protobufjs that both libsignal-node
and any other consumers resolve through normal module resolution.
Why not bump baileys: npm-published baileys@6.17.16 is deprecated by the
maintainers (wrong version), 7.0.0-rc.* still pulls the same vulnerable
libsignal-node, and upstream Baileys HEAD adds a 4th vuln (music-metadata).
The override is the minimal, behavior-preserving fix.
Validation:
- npm audit: 3 critical -> 0 vulnerabilities
- node -e "import('@whiskeysockets/baileys')" -> all 5 named exports
(makeWASocket, useMultiFileAuthState, DisconnectReason,
fetchLatestBaileysVersion, downloadMediaMessage) resolve
- node bridge.js loads all modules and reaches Express bind
(exits only on EADDRINUSE because the live gateway owns :3000)
- Single deduped protobufjs@7.5.6 in the tree
2026-05-03 05:22:30 -07:00
|
|
|
},
|
|
|
|
|
"overrides": {
|
|
|
|
|
"protobufjs": "^7.5.5"
|
2026-02-25 21:04:36 -08:00
|
|
|
}
|
|
|
|
|
}
|