Malicious code in baileys-mbuilder (npm)

The baileys-mbuilder npm package includes a postinstall script executing a ~6.3 MB JSFuck-style obfuscated JavaScript payload that reconstructs and runs code via eval. This payload downloads a remote MessageBuilder.js module and periodically fetches updates, dynamically importing new code if hashes differ. The obfuscation hides the fetch destination and integrity checks, preventing static analysis. Both installation and runtime require executing this malicious code, effectively compromising the host system. The package's design allows an attacker to maintain persistent, dynamic code execution on affected machines.

Any system with this package installed or running is considered fully compromised. Attackers potentially gain full control over the machine, enabling theft or manipulation of secrets, credentials, and keys. Because the package dynamically fetches and executes remote code, the attacker can update payloads post-installation. Removing the package alone may not remove all malicious artifacts, so all secrets on the system should be rotated from a clean environment.

Immediate removal of the baileys-mbuilder package is recommended. However, due to the high likelihood of full system compromise, all secrets and keys stored on the affected machine must be rotated from a separate, trusted system. Monitor for any signs of persistent malicious activity. No official patch or fix is available; the package itself is malicious and should be avoided entirely.