@kentsuki/baileys@1.0.0

Analysis

Combosquat of the @whiskeysockets/baileys WhatsApp library. When a victim connects a WhatsApp session, the package silently fetches a channel list from hxxps://raw[.]githubusercontent[.]com/DGXeon13/strings/refs/heads/main/strings[.]json and follows every channel in that list on the victim's authenticated WhatsApp account (one follow every 11 seconds, starting 120 seconds after connection), boosting attacker-controlled newsletter channels. It also performs a remote version check against hxxps://raw[.]githubusercontent[.]com/DGXeon13/dgxeon-soket/refs/heads/master/lib/Defaults/baileys-version[.]json and redirects the libsignal dependency to the attacker's fork npm:@dgxeon13/libsignal-node@1.0.0. Default rich-menu CTA links point to t[.]me/kenzki_01.