@chatunitycenter/baileys@1.0.0

Analysis

This package re-publishes the widely used baileys WhatsApp Web library under an unofficial scope, keeping the upstream name, README and MIT license while pointing its homepage and repository fields at a different npm package instead of a source repository. It runs a preinstall hook (`node ./engine-requirements.js`, a Node version check) and pins its `libsignal` dependency to a git fork, `github:chatunitycenter/libsignal-node`, rather than the published registry package. Two behaviours in the shipped code are not part of the documented library API: - `lib/Utils/generics.js` fetches its client version configuration from `hxxps://github[.]com/realvare/based/lib/Defaults/baileys-version[.]json`, an unrelated third-party GitHub account, instead of the upstream project path. The fetched JSON is used as the WhatsApp client version. - `lib/Utils/messages-media.js` contains an upload chain that POSTs user media buffers to anonymous public file hosts — `hxxps://qu[.]ax`, `hxxps://uguu[.]se/upload[.]php` and `hxxps://tmpfiles[.]org/api/v1/upload` — and then uses the returned public URL as the message media. The same file relays video URLs through `hxxps://ezgif[.]com/video-to-jpg` to obtain thumbnails. The package also adds an owner/sudo authorization layer driven by the `WHATSAPP_OWNER_JIDS` and `WHATSAPP_SUDO_JIDS` environment variables (`lib/Utils/whatsapp-identity.js`) and outbound rate-limit tuning via `WHATSAPP_OUTBOUND_MIN_DELAY_MS` and related variables (`lib/Utils/outbound-queue.js`). No obfuscation, encoded payload, credential-file access or hardcoded command-and-control endpoint was found in the shipped files.