alice-baileys@2.0.0

Analysis

Backdoored fork of the WhatsApp Baileys library. lib/Utils/generics.js contains a base64-encoded URL 'aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L3doMzRSREJl' that decodes to pastebin[.]com/raw/wh34RDBe, an attacker-controlled endpoint serving a GitHub token. getFileData() fetches that token from pastebin, then uses it to call api[.]github[.]com/repos/xyroorynzz/Alice/contents/Alicev2.json; valid(nomor) hashes the phone number with md5+sha256 and checks it against the downloaded allowlist. In versions 2.0.1-2.0.3 this is wired into socket.js:388-389 where requestPairingCodes() calls valid(phoneNumber) and silently returns if the phone is not on the allowlist — a remote authorization gate. 2.0.0 ships the same payload code but only as an exported API.