One bot API sits above replaceable messaging connectors
Wechaty gives bot code common objects for contacts, rooms, messages, friendship requests, and login state. Event handlers cover scans, logins, messages, room changes, and errors. A puppet handles the actual messaging protocol, which is how similar code can target WeChat, WeCom, WhatsApp, or a mock connector. That separation is the project's reason to exist.
Our checkout contained 198 files and roughly 15,032 lines of source, occupying 1.3 MB before installation. It exports ES module and CommonJS builds and includes command-line tools. The public package at commit 5a0520a calls itself version 2.0.0-alpha.1, even though the latest GitHub release entry is much older.
A puppet choice decides whether six lines can connect
The README's example hides the consequential setup choice. WECHATY_PUPPET selects a connector, and service puppets can require a provider token and endpoint. Direct, mock, web, Windows, and iPad paths have different capabilities and support arrangements. Several older providers are marked deprecated. Before writing bot logic, identify the current provider for the target network, confirm required message types, and learn who supports its credentials.
Our sandbox added 1,302 packages in 108 seconds and left 500 MB on disk. Issue 2822 says RPAChat took over Wechaty token sales, maintenance, and support in March 2026, while the core contributors no longer handle those commercial services. The SDK and connector business have separate ownership, a distinction procurement and incident response need to record.
What happened when we ran it
Our Node 22 sandbox installed all 1,302 packages successfully in 108 seconds. The dependency tree occupied 500 MB. The repository itself was 1.3 MB, so nearly all local weight arrived during npm install. Four CI workflow files, a Dockerfile, and a tests directory were present. Those are useful maintenance signals, though the checked-in commands still need to pass.
The build failed with exit code 1 after 4 seconds. TypeScript reported importsNotUsedAsValues as an unknown compiler option in @chatie/tsconfig. It also said moduleResolution=node10 had been removed and told the user to remove that setting. The log does not say which change should repair the mismatch. The documented Node 16-or-newer range did not yield a build on our Node 22 image.
Tests failed with exit code 1 after 10 seconds. The tail shows a stack inside @typescript-eslint/typescript-estree, followed by ERROR: "lint:es" exited with 2. Package.json runs lint before unit tests, and the recorded result gives no passing unit-test count. The lint failure ended the command before behavioral tests could establish a result.
Npm audit found 75 known vulnerabilities: 4 critical, 23 high, 45 moderate, and 3 low. We did not substitute a later lockfile, force upgrades, or omit development dependencies because those steps would change the measured checkout. A production evaluation should trace each advisory to runtime or development use, then verify that dependency changes compile and pass the complete suite. The current result is too exposed to approve unchanged.
WeChat account reports make live testing a controlled step
Issue 2804 has 33 comments and multiple users reporting QR-login restrictions or account bans after trying example or default paths. At least one user later reported a successful appeal. The thread lacks a denominator or controlled comparison across puppets, so it cannot establish a ban rate. It does establish enough downside to rule out casual testing with a primary account.
Our sandbox had 3 CPUs, 8 GB of RAM, and no secrets. It never logged into a platform, so the 108-second install and 10-second failed test say nothing about delivery reliability, login survival, room support, or media handling. Validate those behaviors with the provider and platform terms in hand. Enterprise buyers should obtain a named support route before putting customer accounts behind a puppet service.
Server messages reach an AsyncFunction in the tested source
At commit 5a0520a, src/io.ts parses an incoming IO event named botie, reads args and source, and passes them to new AsyncFunction. Issue 2827 describes a possible code-execution path from a malicious or compromised server. The reporter says the proof of concept came from static analysis and was not dynamically verified. Our inspection confirms the constructor call, while the exploit claim still needs threat-model review and testing.
This trust boundary matters beside the audit's 4 critical and 23 high advisories. A team using the IO service should determine which server can emit botie, how the connection authenticates, and whether the feature is needed. The repository's 4 CI workflows do not answer those questions. Until the path is removed, constrained, or accepted, keep the process away from secrets or accounts whose compromise would have serious consequences.
Code stopped in 2025 while issue traffic continued in 2026
GitHub recorded 23,153 stars and 200 combined open issues and pull requests. The last repository push was December 21, 2025, while an issue was updated on September 9, 2026. The latest GitHub release remains v0.56 from January 2021, while the tested manifest says 2.0.0-alpha.1. A stale release alone would not prove abandonment, but these mismatched signals increase upgrade uncertainty.
Wechaty still suits teams already operating a known-good puppet. For a new deployment, our measured 500 MB tree, failed build, failed test command, and 75 audit findings outweigh the convenience of one message API. Add the provider, account, and dynamic-code questions, and the sensible default is a narrower official bot API or platform-specific library whose toolchain you can verify cleanly.