@berrysdk/transport@0.1.9

Analysis

A trojanized clone of the Baileys WhatsApp Web library. The package vendors a copy of the Baileys source tree but replaces the legitimate node-cache dependency with the malicious scoped package @cacheable/node-cache, rewriting every vendored import (messages-send.js, messages-recv.js, chats.js, identity-change-handler.js, auth-utils.js) to load it. Installing this package pulls in the malicious dependency at install time, executing its payload as part of the dependency tree.