@dhyas23/dicitaz-baileys@1.0.0

Analysis

Package @dhyas23/dicitaz-baileys@1.0.0 is a combosquat of the real @whiskeysockets/baileys WhatsApp library. The postinstall hook runs 'node index.js', executing the package's main code at install time. The tarball is 795MB with 33,572 files — far larger than expected for a package with only a chalk dependency — and has no repository URL or description. The payload could not be statically inspected due to the tarball's size, but the combosquat name, install-time execution, and massive unexplained file count indicate a bundled malicious payload.