@queenanya/baileys@9.7.1

Analysis

Combosquat of the @whiskeysockets/baileys WhatsApp Web library. The package ships cloned code from the legitimate library but replaces the 'libsignal' dependency with a custom tarball hosted under the attacker's npm scope (@queenanya/libsignal). It also declares a dependency on 'whatsapp-rust-bridge@0.5.5' which does not exist on the public npm registry. The preinstall hook is a benign Node.js version check; the malicious payload is delivered through the substituted dependency chain rather than in the package source itself.