@animebails/baileys@1.0.0

Analysis

@animebails/baileys is a modified fork of the canonical @whiskeysockets/baileys WhatsApp automation library, published under an unrelated scope, whose code silently enrols the operator's WhatsApp account in the author's channels. In lib/Socket/newsletter.js, makeNewsletterSocket schedules a setTimeout of 90000 ms and, when it fires, issues w:mex QueryIds.FOLLOW queries for two hardcoded channel JIDs — 120363421589882800@newsletter and 120363425383414251@newsletter — with every error swallowed. The follow is unconditional, fires on every socket creation rather than at install, and has no configuration switch, so any application built on this fork subscribes its WhatsApp account to those channels; the package's own keywords and description ("ron-tech whatsapp baileys modification", Fluxion / fluxcorp) confirm a modified fork rather than an upstream release. The author's channels are advertised at whatsapp[.]com/channel/0029VaranC0KmCPQCHryFs2C and whatsapp[.]com/channel/0029Vb7Lbw76LwHcPKCkvg2S. The package's preinstall hook, engine-requirements.js, only verifies the Node.js major version and exits. No credentials, tokens, environment variables, credential files or wallet data are read or transmitted; the behaviour is unauthorised account-level channel subscription, not exfiltration.