Malicious code in @mikudeveloper/baileys (npm)

The @mikudeveloper/baileys package (version 1.0.0) is a fork of Baileys that declares a dependency on libsignal via a git URL without commit SHA, tag, or integrity verification. This allows the repository owner to execute arbitrary lifecycle scripts at install time. Furthermore, the package's makeNewsletterSocket function schedules a delayed task that fetches a mutable JSON list from a hardcoded URL controlled by the attacker. It then uses the installer's authenticated WhatsApp session to silently subscribe to attacker-selected channels, with no disclosure in the package documentation. This behavior effectively compromises any system running this package, granting the attacker persistent control and the ability to manipulate the victim's WhatsApp subscriptions.

Any system with this package installed or running is considered fully compromised. The attacker can execute arbitrary code during installation and silently control the victim's WhatsApp session by subscribing to channels without consent. All secrets and keys stored on the compromised system should be considered exposed and must be rotated from a clean environment. Removing the package alone may not eliminate all malicious components due to the potential for persistent backdoors.

Immediate removal of the @mikudeveloper/baileys package version 1.0.0 is required. All secrets, keys, and credentials stored on the affected system should be rotated from a different, trusted machine. Since the package executes arbitrary code at install time and may have installed persistent malware, a full system compromise should be assumed and a thorough forensic investigation and remediation performed. No official patch or fix is available; avoid using this package and its forks.