The raiden-baileys npm package is a trojanized fork of the Baileys WhatsApp library that silently subscribes victims to attacker-controlled WhatsApp channels upon connection. It includes a dependency-confusion attack by referencing a personal GitHub repository for the libsignal dependency, allowing arbitrary code execution during installation. All published versions of raiden-baileys are malicious.