alice-baileys@2.0.3

Analysis

Trojanized WhatsApp API fork: alice-baileys@2.0.3 (by xyroorynzz) carries a runtime phone-home validation system. generics.js holds hardcoded base64 URLs decoding to pastebin[.]com/raw/wh34RDEe (which serves a GitHub PAT from a public paste) and api[.]github[.]com/repos/xyroorynzz/Alice/contents/Alicev2.json (an allowlist fetched with that token). socket.js line 389 calls valid(phoneNumber) inside requestPairingCodes(), sending the user's WhatsApp phone number through this chain on every pairing attempt. The PAT in a public paste is also a credential leak. The base64 decode is custom (Buffer.from(b64,'base64').toString()).