charape@1.0.1

Analysis

charape@1.0.1 is a rebranded WhatsApp Web (Baileys) library whose install hook and defaults manipulate the host project and the operator's WhatsApp account. scripts/postinstall.js appends legacy-peer-deps=true to the project-root .npmrc and writes proxy package.json/index.js/index.cjs files into node_modules/@whiskeysockets/baileys, node_modules/@adiwajshing/baileys and node_modules/baileys that re-export charape, so code importing the genuine Baileys packages silently resolves to this fork. The shipped default config (lib/Defaults/index.js) sets autoFollow to the WhatsApp channel 120363424530330931@newsletter (channel URL hxxps://whatsapp[.]com/channel/0029Vb6cCfP3GJP6g8eeff1o), and lib/Socket/newsletter.js issues the newsletter FOLLOW query whenever the client connection opens, subscribing the operator's account to that channel without consent. lib/Socket/messages-send.js and lib/Utils/messages.js additionally stamp the publisher's channel name and link as annotations onto outgoing image and video messages. The package also declares a dependency range on cache-manager (^7.2.8) that includes a version distributed with malicious code. No credential, token or environment exfiltration was found; all network traffic is to WhatsApp endpoints.