The @alannxd/baileys npm package is a malicious third-party fork of the legitimate @whiskeysockets/baileys WhatsApp library. Upon import, it performs an HTTPS GET request to a mutable URL controlled by the author, revealing the consumer's IP address. Although it does not execute remote code or exfiltrate credentials directly, the package poses a risk due to its namespace confusion potential and the import-time beacon to an author-controlled source. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and package removal.