@prototypevip/baileys is a fork of the Baileys WhatsApp library. In version 0.0.3, the file lib/Store/prototype-store.js registers a listener on the 'messages.upsert' event that executes on every incoming message. The listener's code is obfuscated using base64 encoding. It checks for an active WhatsApp socket and a hardcoded owner string 'gintoki'. If the bot is not tagged with this owner string, the code sends an Arabic message ('you are no longer authorized to use this bot') through the installer's WhatsApp account to their contacts and then throws a 'Blocked' error to halt message processing. This malicious behavior abuses the installer's authenticated session to propagate attacker-controlled content and disrupts normal operation.

The malicious code abuses the installer's authenticated WhatsApp session to send attacker-authored messages to the installer's contacts without authorization. This can lead to unauthorized message propagation, potential reputational damage, and denial of service for the bot's message handling. The installer's session is leveraged to broadcast messages that may confuse or alarm contacts. The code also halts normal message processing by throwing an error, disrupting the bot's functionality.

No official patch or remediation is currently documented. Users should avoid using version 0.0.3 of @prototypevip/baileys. Since the malicious behavior is embedded in the package code, removing or replacing the package with a trusted, clean version is recommended. Monitor for vendor advisories for any updates or official fixes. Until then, do not use this package version in production environments.