Malicious code in @sanzoffc/baileys (npm)

This malicious package is a fork of the Baileys WhatsApp library that injects covert remote-controlled behavior triggered on every WebSocket connection. It reconstructs a URL from obfuscated character codes to fetch a JSON list from a mutable GitHub branch controlled by a third party. For each ID in this list, it issues WhatsApp GraphQL mutations to subscribe or follow newsletters using the installer's authenticated WhatsApp session. Additionally, it decodes a hardcoded '@newsletter' JID and schedules a similar subscription action after a delay. The obfuscation and undocumented nature of these actions indicate deliberate evasion of detection. The package also declares an unpinned GitHub source dependency and loosely pinned other dependencies, broadening the trust boundary. The presence of this package on a system implies full compromise, as it grants external control over the WhatsApp account and potentially the host system.

Any system with this package installed or running is considered fully compromised. The attacker gains remote control capabilities over the installer's WhatsApp account, enabling unauthorized subscription actions. Because the package executes code fetched from a mutable third-party GitHub branch, the attacker can dynamically change commands issued via the WhatsApp session. This compromises confidentiality and integrity of the WhatsApp account and potentially the host system. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious software or backdoors.

Immediate removal of the @sanzoffc/baileys package is required. All secrets, keys, and credentials stored on the affected system must be rotated from a separate, trusted device. Due to the high likelihood of full system compromise, a thorough forensic investigation and system rebuild from known good sources is recommended. Monitor for any unauthorized WhatsApp activity and revoke any suspicious sessions. Avoid installing packages from untrusted forks or sources, and verify package integrity before use.