The @xsat10/baileys-xsat npm package (version 2.0.0) is a malicious fork of the Baileys WhatsApp Web library. Static analysis detected code patterns consistent with Baileys functionality but raised concerns due to the fork's history of embedding covert side effects such as auto-following author-controlled newsletters and install counters using the victim's authenticated WhatsApp session. No direct evidence of data exfiltration or non-first-party destinations was found in the matched code paths. However, the package is flagged as fully compromising any system where it is installed, implying potential full system compromise.

Any computer with this package installed should be considered fully compromised. Attackers may have gained full control over the system, including access to all stored secrets and keys. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate secret and key rotation from a separate, trusted device is necessary to mitigate ongoing risk.

Remove the @xsat10/baileys-xsat package immediately from all affected systems. Rotate all secrets and keys stored on compromised computers from a different, secure device. Due to the potential full system compromise, further forensic investigation and remediation may be required. No official patch or fix is available; the package itself is malicious and should not be used.