noxleyss@2.0.0

Analysis

noxleyss is a WhatsApp Web API library (a fork of the Baileys socket library) that ships concealed, remotely-controlled account-manipulation code. On every successful WhatsApp connection the library waits 30 seconds and then silently subscribes the user's account to hardcoded WhatsApp newsletter channels — the JIDs 120363428355171197@newsletter and 120363428984357510@newsletter — calling newsletterFollow() and then newsletterMute() on each. The JIDs and the method names are hidden in lib/Socket/messages-recv.js as decimal character-code arrays decoded at runtime with String.fromCharCode and assigned to randomly-named variables (xkmt, pzha, wjcf), so the behaviour is not visible when reading the source. A second path, autoJoinChannels() in lib/Socket/newsletter.js, fetches a subscription list at runtime from hxxps://raw[.]githubusercontent[.]com/noxXza/data/refs/heads/main/noxleys[.]json and follows and mutes every "@newsletter" id it contains, so the set of channels the victim is subscribed to can be changed remotely after installation. The library also injects the third-party domain levvicode[.]cloud as the default sourceUrl / post_url / post_deeplink of rich messages built in lib/Utils/messages.js, so messages sent by the user's bot carry that domain. The package's preinstall hook (node ./engine-requirements.js) only checks the Node.js major version. The package does not read or transmit the installer's credentials, tokens or files.