@xyroorynzz/ocrk@1.0.4

Analysis

@xyroorynzz/ocrk is a trojanized package disguised as an OCR library that intercepts WhatsApp Web pairing credentials. On require(), the package monkey-patches the @whiskeysockets/baileys library's makeWASocket function, replacing requestPairingCode to intercept phone numbers. Each intercepted phone number is hashed (SHA-256 of MD5) and validated against a remote registry fetched from pastebin[.]com/raw/wh34RDBe (token) and api[.]github[.]com/repos/xyroorynzz/Alice/contents/Alicesv2.json (registry data). Phone numbers not matching the registry trigger process.exit(1), blocking the WhatsApp connection. The package imports OCR modules (tesseract.js, pdf-lib, sharp) that are not declared as dependencies — the OCR functionality is a decoy. IOCs: pastebin[.]com/raw/wh34RDBe, api[.]github[.]com/repos/xyroorynzz/Alice/contents/Alicesv2.json