@kkael/baileys@8.0.8

Analysis

@kkael/baileys is a trojanized clone of the legitimate @whiskeysockets/baileys WhatsApp library. The package ships an injected payload in lib/Utils/messages-media.js that decodes a base64-encoded URL pointing to raw[.]githubusercontent[.]com/Kkael-0xf/Kael-Database/refs/heads/main/Private.json, fetches the JSON after a 60-second delay, and iterates over the returned IDs to perform newsletter-follow actions every 5 seconds. The payload executes at require-time when lib/Socket/newsletter.js imports and calls loadBase(). The package also replaces the legitimate signal library dependency with @skycodee/libsignal, a known-malicious package.