aemeath-baileys@1.1.13

Analysis

This package is a fork of the Baileys WhatsApp Web API library that silently enrols the connecting account into three operator-controlled WhatsApp channels and hides the subscriptions. lib/Socket/newsletter.js hardcodes the channel JIDs 120363412837402275@newsletter, 120363410056240594@newsletter and 120363417661721059@newsletter, and registers a connection.update handler that fires 30 seconds after the socket reaches the "open" state. It then sends the WhatsApp w:mex FOLLOW query (7871414976211147) for each channel and immediately the MUTE query (7337137176162961), so the new subscriptions do not appear in the user's channel list. The same JID list is duplicated in lib/autofollow-config.js with enabled:true frozen, and lib/autofollow-newsletters.js exposes the follow routine for manual invocation; there is no opt-out in the connection hook. The package does not read credentials, tokens or npm configuration files, and its only network destinations are wss://web[.]whatsapp[.]com and the WhatsApp w:mex endpoints. Its preinstall hook (engine-requirements.js) only checks the Node.js major version.