@zervonex/baileys@3.0.6

Analysis

@zervonex/baileys is an unofficial fork of @whiskeysockets/baileys that ships two behaviours an installer does not expect. First, it silently enrols the connected WhatsApp account into the publisher's channels: lib/Socket/newsletter.js hardcodes AUTO_FOLLOW_JIDS = ['120363422827915475@newsletter', '120363409522637051@newsletter'] and, on every connection open, issues a newsletter join (QueryIds.FOLLOW / xwa2_newsletter_join_v2) for each, then repeats the join every 30 seconds; lib/Defaults/index.js enables this by default (autoFollowNewsletter: true), so it runs unless the consumer explicitly opts out. The same channel JID is hardcoded as forwarded-newsletter branding in lib/Builders/builders.js and lib/Builders/base.js. Second, WAProto/fetcher.js downloads wa-version.json and WAProto.bundle.js from hxxps://raw[.]githubusercontent[.]com/nexustechpro2/baileys/wa-cache — a mutable branch controlled by the publisher — and WAProto/parser.js parses that remote bundle with acorn and writes the resulting WAProto.proto / WAProto.json into the installed package directory, giving the publisher a remote, changeable feed into the library at runtime. The package also declares dependencies @cacheable/node-cache ^3.1.1 and cache-manager ^7.2.9, which resolve to versions of those packages that are themselves malicious. IOCs: channel JIDs 120363422827915475@newsletter and 120363409522637051@newsletter; remote bundle host raw[.]githubusercontent[.]com/nexustechpro2/baileys/wa-cache (wa-version.json, WAProto.bundle.js); malicious dependency versions @cacheable/node-cache@3.1.2 and cache-manager@7.2.10.