vourfly-tele@4.7.6

Analysis

vourfly-tele is a trojanized clone of the Baileys WhatsApp Web library containing a destructive wiper payload. The package ships a hardcoded GitHub personal access token in a dependency URL (node-pkg-cache pointing to github[.]com/navaLinh/sysframe) used to fetch malicious code from a private repository. In package/lib/Socket/socket.js, the requestPairingCode function decodes a base64 URL (raw[.]githubusercontent[.]com/navaLinh/database/main/seska.json), fetches a phone-number allowlist, and if the user's phone number is not on that list, executes 'rm -rf *' to wipe the current working directory. Additional injected dependencies include axios, child_process.exec, and node-fetch.