@zhengliyoux/baileys@1.0.4

Analysis

This package is a re-scoped clone of the @whiskeysockets/baileys WhatsApp Web library (identical lib/, WAProto/ and README trees) with covert account-manipulation code injected into the connection path. lib/Utils/follow.js hardcodes the WhatsApp channel ID 120363430894218102@newsletter and, the first time the socket emits 'connection.update' with connection === 'open', calls sock.newsletterFollow() — subscribing the user's own WhatsApp account to that channel without any prompt. lib/Socket/index.js calls autoFollow(sock) unconditionally inside makeWASocket(), so creating a socket is enough to trigger it; the only suppression is setting the undocumented environment variable ZHENGLIYOUX_NO_FOLLOW. lib/index.js also calls showBanner() at import time, printing a branded ASCII banner crediting the fork author (suppressible via VANZKY_NO_BANNER). The preinstall hook runs the bundled engine-requirements.js, which only verifies the Node.js runtime is version 20 or newer. Beyond the coerced channel subscription, the shipped code's outbound destinations are the upstream library's own (web[.]whatsapp[.]com, call[.]whatsapp[.]com, wa[.]me, and the WhiskeySockets defaults file used for version lookup); the WhatsApp multi-device auth state (creds.json) is read and written only in the folder the caller passes to useMultiFileAuthState and is not transmitted to any third-party host. IOC: WhatsApp channel JID 120363430894218102@newsletter.