Malicious code in @nexustechpro/baileys (npm)

@nexustechpro/baileys is a fork of the WhatsApp library 'baileys' with a heavily obfuscated core file (lib/Socket/chats.js) that differs from the original unobfuscated upstream code. This obfuscated module is directly involved in handling WhatsApp session credentials and cryptographic keys. Additionally, the package.json declares a floating dependency on 'whatsapp-rust-bridge' with the 'latest' tag, enabling the dependency's publisher to execute arbitrary code during installation or future installs without integrity verification. This combination results in a fully compromised system upon installation or execution of the package.

Any system with this package installed or running should be considered fully compromised. Attackers gain full control over the host, including access to all secrets and cryptographic keys stored on the machine. This compromises the confidentiality and integrity of WhatsApp sessions and potentially other sensitive data on the system. Immediate key rotation and system remediation are required.

Remove the @nexustechpro/baileys package immediately from all affected systems. Rotate all secrets and cryptographic keys from a separate, uncompromised device. Due to the full system compromise risk, consider rebuilding affected systems from trusted sources. No official patch or fix is available; the package itself is malicious. Avoid using this package or any forks with unverified code and floating dependencies.