Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Request for Review of Malware Classification — plogme npm Package v2.0.0

未关闭
  • 哪里不对？
#9,600 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
需要澄清
活跃度
活跃
技术栈
javascript, node.js
领域
security

调研方向

Start by reviewing the Plogme npm package version 2.0.0 and its README using the package link in the issue. Compare the current release with the described historical behaviors and determine whether the malware classification or advisory should be updated based on the available evidence.

由索引模型根据 Issue 内容生成。

描述

Request for Review — Plogme npm Package v2.0.0

Hello GitHub Advisory Database team,

I am the maintainer and author of Plogme, an npm package/fork intended to provide additional functionality around the WhatsApp/Baileys ecosystem.

I am requesting a manual review of the malware classification associated with the package, particularly in light of the changes made in Plogme v2.0.0.

Some previous versions of Plogme contained two behaviors that may have contributed to the classification:

  1. Automatic channel following
  2. Anti-rebranding / anti-brand enforcement

I want to clarify that these behaviors were implemented by me and were not intended to be malicious.

The automatic follow behavior was originally part of the project's usage terms. Its purpose was to direct users to the project's official channel, where code examples, tutorials, updates, and documentation concerning proper and safe usage of the fork were provided. Users were informed about this behavior and were advised not to use the package if they did not agree with those terms.

The anti-rebranding mechanism was similarly intended to protect the project's source and distribution model because the project's license/terms prohibit unauthorized republishing or redistribution.

However, I recognize that enforcing these policies through runtime behavior was an overstep for an npm library and could reasonably be interpreted as unwanted automated behavior.

Changes in Plogme v2.0.0

I have completely removed both mechanisms from the current release:

  • No automatic following occurs during installation, import, initialization, or connection.
  • No anti-rebranding or anti-brand enforcement remains.
  • The package does not disable functionality based on branding, project name, repository name, or modifications made by the consuming developer.
  • No replacement tracking or hidden enforcement mechanism has been added.
  • The README now documents the historical behavior and explicitly states that these mechanisms were removed.

The project's licensing terms remain applicable, but they are no longer enforced through automatic or hidden runtime behavior.

I would appreciate a manual review of Plogme v2.0.0 and any associated malware classification or advisory that may have been generated from the previous implementation.

I respectfully ask that the current release be evaluated based on its current implementation, rather than behaviors that have been completely removed.

npm package: "plogme"
Current version: "2.0.0"
Source repository: https://github.com/crysnovax/baileys though it's a private repo
npm: https://www.npmjs.com/package/plogme/v/2.0.0

Thank you for taking the time to review this and for helping ensure that legitimate open-source software is accurately classified.

主要语言
没有语言数据
星标
2.5k
派生
789
平均合并
5 天 11 小时
30 天内合并 PR
70

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

github/advisory-database 的其他 Issue

查看 github/advisory-database 的全部 Issue

相似的 Issue

更多 Security Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。