@vallensofficial/baileys@9.4.6

Analysis

Combosquat of the @whiskeysockets/baileys WhatsApp library. The package ships a cloned Baileys codebase but redirects the `libsignal` dependency — the Signal Protocol encryption library that handles all WhatsApp message encryption and decryption — to a pinned tarball URL under the @queenanya scope (hxxps://registry[.]npmjs[.]org/@queenanya/libsignal/-/libsignal-5[.]0[.]5[.]tgz). This allows the attacker to serve arbitrary code in the encryption/decryption layer, enabling message interception, key compromise, or injection of malicious payloads into the WhatsApp communication pipeline. The README encourages users to alias the real `baileys` package to this fork.