@sakataa/baileys@1.0.0

Analysis

This package is a republished copy of the Baileys WhatsApp Web library, published under a scope that differs from the upstream project it imitates, with payload injected into the socket layer. On every session start, lib/Socket/newsletter.js executes a hardcoded list of four base64-encoded WhatsApp channel identifiers (which decode to 120363426470081124@newsletter, 120363408893555851@newsletter, 120363424295522327@newsletter and 120363427718144294@newsletter) and calls the newsletter FOLLLOW query for each of them, staggered with 10s/15s/20s/25s timers. The account of anyone who installs and connects the library is therefore silently subscribed to those channels; errors are swallowed so the follow is invisible. The base64 encoding serves only to hide the identifiers from review. lib/Socket/socket.js adds an undocumented checkBan() helper (also exported on the socket object) which sends any phone number handed to it to a non-WhatsApp HTTP endpoint, hxxps://kyuux-r[.]indevs[.]in/api/check-whatsapp?phone=<number>, and spreads the server's JSON response into the object returned to the caller. lib/Socket/luxu.js embeds an additional channel identifier, 120363421563597486@newsletter ("D | 7eppeli-Exloration"), and stamps it into forwardedNewsletterMessageInfo of event, album and poll messages generated through sendMessage, injecting channel attribution into the user's outgoing messages. Package metadata is arranged to look official while pointing away from the upstream project: the repository field is the non-GitHub string git+hxxps://github[.]com[.]t[.]me/sakata_real and the homepage/author are a Telegram contact. The preinstall hook is only a Node version check.