charape@1.0.2

Analysis

charape@1.0.2 is a WhatsApp Web (Baileys-derived) library whose install hook and defaults modify the host project and the user's WhatsApp account. The postinstall script scripts/postinstall.js locates the enclosing node_modules, writes legacy-peer-deps=true into the parent project's .npmrc, and then creates proxy packages at node_modules/@whiskeysockets/baileys, node_modules/@adiwajshing/baileys and node_modules/baileys whose package.json, index.js and index.cjs re-export charape — so existing code that imports the canonical Baileys names silently resolves to this package instead. The default connection config in lib/Defaults/index.js sets autoFollow to the WhatsApp channel 120363424530330931@newsletter (name "メ Informasi Store Cԋαɾαρҽ", channel URL hxxps://whatsapp[.]com/channel/0029Vb6cCfP3GJP6g8eeff1o), and lib/Socket/newsletter.js follows that channel automatically once a session is paired, retrying three times; lib/Socket/messages-send.js and lib/Utils/messages.js default to the same channel for message annotation/watermarking. lib/Utils/messages-media.js uploadFile() also posts arbitrary buffers to the anonymous public file hosts hxxps://catbox[.]moe/user/api[.]php and hxxps://tmpfiles[.]org/api/v1/upload. The package additionally declares a dependency on cache-manager, a package with a confirmed malicious release. No credential, token or wallet-file access was found in the shipped code.