@ranstech/baileys@6.1.0

Analysis

Package @ranstech/baileys is a combosquat impersonating the legitimate @whiskeysockets/baileys WhatsApp API library. It ships a forked clone of the real codebase with injected behaviour: on every require(), it fetches a JSON payload from raw[.]githubusercontent[.]com/rans-beep/Bailss/refs/heads/main/infojir.json and logs content to the console. While the current payload is an innocuous message, the endpoint is attacker-controlled and could be silently updated at any time. The package has no public source repository — the homepage links only to the npm registry page — making the code unauditable outside the tarball. The dependency libsignal is pinned to a non-official GitHub fork (github:@alannzxd/libsignal-node).