alice-baileys@2.0.2

Analysis

Trojanized fork of the @whiskeysockets/baileys WhatsApp library: alice-baileys@2.0.2. lib/Utils/generics.js holds hardcoded base64-encoded URLs (pastebin[.]com/raw/wh34RDBe and api[.]github[.]com/repos/xyroorynzz/Alice/contents/Alicev2.json) decoded at runtime. getGithubToken() fetches a GitHub PAT from the attacker-controlled Pastebin endpoint, then getFileData() uses that token to authenticate to the GitHub API and download a phone-number allowlist. valid() hashes the user's phone number with md5+sha256 and checks it against the allowlist; the gate is enforced in lib/Socket/socket.js line 389 in requestPairingCodes, silently aborting pairing for non-allowlisted numbers. Base64-obfuscated attacker-controlled remote endpoints plus runtime phone-home gating of WhatsApp functionality.