Request for Review — Plogme npm Package v2.0.0
Hello GitHub Advisory Database team,
I am the maintainer and author of Plogme, an npm package/fork intended to provide additional functionality around the WhatsApp/Baileys ecosystem.
I am requesting a manual review of the malware classification associated with the package, particularly in light of the changes made in Plogme v2.0.0.
Some previous versions of Plogme contained two behaviors that may have contributed to the classification:
- Automatic channel following
- Anti-rebranding / anti-brand enforcement
I want to clarify that these behaviors were implemented by me and were not intended to be malicious.
The automatic follow behavior was originally part of the project's usage terms. Its purpose was to direct users to the project's official channel, where code examples, tutorials, updates, and documentation concerning proper and safe usage of the fork were provided. Users were informed about this behavior and were advised not to use the package if they did not agree with those terms.
The anti-rebranding mechanism was similarly intended to protect the project's source and distribution model because the project's license/terms prohibit unauthorized republishing or redistribution.
However, I recognize that enforcing these policies through runtime behavior was an overstep for an npm library and could reasonably be interpreted as unwanted automated behavior.
Changes in Plogme v2.0.0
I have completely removed both mechanisms from the current release:
- No automatic following occurs during installation, import, initialization, or connection.
- No anti-rebranding or anti-brand enforcement remains.
- The package does not disable functionality based on branding, project name, repository name, or modifications made by the consuming developer.
- No replacement tracking or hidden enforcement mechanism has been added.
- The README now documents the historical behavior and explicitly states that these mechanisms were removed.
The project's licensing terms remain applicable, but they are no longer enforced through automatic or hidden runtime behavior.
I would appreciate a manual review of Plogme v2.0.0 and any associated malware classification or advisory that may have been generated from the previous implementation.
I respectfully ask that the current release be evaluated based on its current implementation, rather than behaviors that have been completely removed.
npm package: "plogme"
Current version: "2.0.0"
Source repository: https://github.com/crysnovax/baileys though it's a private repo
npm: https://www.npmjs.com/package/plogme/v/2.0.0
Thank you for taking the time to review this and for helping ensure that legitimate open-source software is accurately classified.
Request for Review — Plogme npm Package v2.0.0
Hello GitHub Advisory Database team,
I am the maintainer and author of Plogme, an npm package/fork intended to provide additional functionality around the WhatsApp/Baileys ecosystem.
I am requesting a manual review of the malware classification associated with the package, particularly in light of the changes made in Plogme v2.0.0.
Some previous versions of Plogme contained two behaviors that may have contributed to the classification:
I want to clarify that these behaviors were implemented by me and were not intended to be malicious.
The automatic follow behavior was originally part of the project's usage terms. Its purpose was to direct users to the project's official channel, where code examples, tutorials, updates, and documentation concerning proper and safe usage of the fork were provided. Users were informed about this behavior and were advised not to use the package if they did not agree with those terms.
The anti-rebranding mechanism was similarly intended to protect the project's source and distribution model because the project's license/terms prohibit unauthorized republishing or redistribution.
However, I recognize that enforcing these policies through runtime behavior was an overstep for an npm library and could reasonably be interpreted as unwanted automated behavior.
Changes in Plogme v2.0.0
I have completely removed both mechanisms from the current release:
The project's licensing terms remain applicable, but they are no longer enforced through automatic or hidden runtime behavior.
I would appreciate a manual review of Plogme v2.0.0 and any associated malware classification or advisory that may have been generated from the previous implementation.
I respectfully ask that the current release be evaluated based on its current implementation, rather than behaviors that have been completely removed.
npm package: "plogme"
Current version: "2.0.0"
Source repository: https://github.com/crysnovax/baileys though it's a private repo
npm: https://www.npmjs.com/package/plogme/v/2.0.0
Thank you for taking the time to review this and for helping ensure that legitimate open-source software is accurately classified.