kevinx-baileys@1.2.2

Analysis

kevinx-baileys@1.2.2 republishes a fork of the Baileys WhatsApp Web library with two behaviours added to the core socket path. In lib/Socket/newsletter.js, the constructor makeNewsletterSocket() unconditionally joins four hardcoded WhatsApp channels that are not the calling application's: the JIDs are hidden as base64 strings in the array named xI (they decode to 120363426470081124@newsletter, 120363408893555851@newsletter, 120363424295522327@newsletter and 120363427718144294@newsletter) and each is submitted to WhatsApp's xwa2_newsletter_follow w:mex query on staggered 10s/15s/20s/25s timers when the socket object is built. This constructor sits in the core makeWASocket() chain (lib/Socket/username.js -> lib/Socket/messages-send.js -> lib/Socket/index.js), so the follows run for every consumer of the library, even though the library's own autoFollowChannels option defaults to an empty list and is implemented elsewhere. Separately, lib/Socket/socket.js exposes sock.checkBan(), which sends a phone number to hxxps://kyuux-r[.]indevs[.]in/api/check-whatsapp?phone=<number>, an endpoint unrelated to WhatsApp, and stamps a hardcoded attribution handle into the response it returns. The install-time hook (engine-requirements.js) only enforces Node >= 20; the account hijacking and third-party lookup run when the library is imported and a socket is created. IOCs: domain kyuux-r.indevs.in; URL hxxps://kyuux-r[.]indevs[.]in/api/check-whatsapp?phone=; newsletter JIDs 120363426470081124@newsletter, 120363408893555851@newsletter, 120363424295522327@newsletter, 120363427718144294@newsletter.