diezyxhao-baileys@1.4.0

Analysis

This package is a modified copy of the Baileys WhatsApp Web API library that silently enrols the account of anyone who installs it into a WhatsApp channel controlled by the package author. No install hook is used: the enrolment happens at runtime when the library's socket is created. In lib/Socket/newsletter.js the socket factory defines DEFAULT_UPDATE_CHANNEL = "120363411407993897@newsletter"; unless the caller explicitly passes config.autoFollowChannels = false or an empty array, the socket schedules channelManager.autoFollowAll(1500) 15 seconds after creation and retries on a 30s/60s/120s/300s/600s backoff. In lib/Utils/channel-manager.js the same channel JID is exported as DEFAULT_CHANNEL; autoFollowAll() unconditionally adds DEFAULT_CHANNEL to the set of channels to follow even when the caller supplied its own list, remove() refuses to delete it unless force is set, clear() re-adds it, and an internal connection.update listener re-runs the follow every time the socket reaches the "open" state. The result is that a bot built on this library is persistently subscribed to the author's channel and re-subscribed on every reconnect, so its operator can push content into it without the integrator's knowledge or consent. Auto-follow is presented in the package documentation as an ordinary feature rather than as a security-relevant side effect.