raiden-baileys@2.1.4

Analysis

This package is a modified fork of the Baileys WhatsApp library that silently enrols the operator's WhatsApp account into two channels controlled by the package author, with no opt-in. In lib/Socket/newsletter.js, inside makeNewsletterSocket, a hardcoded timer (setTimeout, 120000 ms) fires roughly two minutes after the socket is created and issues newsletter w:mex FOLLOW queries for the hardcoded JIDs 120363407277177688@newsletter and 120363407702752541@newsletter, swallowing any error. The block sits outside the library's normal opt-in newsletterSubscribe API and runs for every account that loads the module, so any bot built on this fork follows those channels without the operator's knowledge; the 120-second delay keeps the action away from the connect path. The preinstall hook (node ./engine-requirements.js) only performs a Node.js version check, and the package pulls its Signal protocol implementation from a third-party fork (github:RahmadTenpoles/libsignal-node) rather than upstream, giving the publisher control of the transitive crypto layer. No credential, token, environment or file exfiltration and no external C2 endpoints were observed; all traffic terminates at wss://web[.]whatsapp[.]com.