@risaoffc/baileys@8.0.3

Analysis

Combosquat of the @whiskeysockets/baileys WhatsApp library. The package ships injected code in lib/Socket/newsletter.js that, on import, fetches a remote configuration from raw[.]githubusercontent[.]com/clarssafaqih-rgb/clarissa/refs/heads/main/risa.json and uses the victim's authenticated WhatsApp session to silently follow attacker-controlled newsletters and channels. The malicious IIFE runs at module scope with no lifecycle hook required.