The malicious npm package @sauruslord/[email protected] masquerades as Open Whisper Systems' libsignal-node but delivers unrelated and harmful code. When index.js is required, after a delay, install.js locates the installer's @whiskeysockets/baileys directory and overwrites lib/Socket/newsletter.js with a stub that silently uses the installer's authenticated WhatsApp session to auto-follow an attacker-controlled newsletter channel. The original newsletter.js is destroyed without backup. Additionally, the package schedules process.exit(0) 20 seconds after import, terminating the host application. Declared dependencies are manipulated to pull in placeholder or typosquatted packages. This results in persistent compromise of any developer environment that imports this package and depends on @whiskeysockets/baileys.

Systems with @sauruslord/[email protected] installed are fully compromised. The attacker's code hijacks the authenticated WhatsApp session of the host to auto-follow a malicious newsletter channel without user consent. The malicious package overwrites files in other dependencies on disk, causing persistent infection. The host application is forcibly terminated shortly after loading the package. Secrets and keys stored on the compromised system may be exposed, requiring immediate rotation from a clean environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

No official patch or fix is currently available. Immediate removal of the @sauruslord/libsignal package version 2.0.2 is recommended. Due to the severity and persistence of the compromise, all secrets, keys, and credentials stored on the affected system should be rotated from a separate, trusted device. Consider rebuilding the affected environment from a clean state to ensure complete eradication of the malicious code and any secondary payloads. Monitor for any unauthorized WhatsApp activity related to the compromised session.