Suspicious 91% javascript Download

@ostyado/baileys 2.0.8

preinstall hook, typosquatting risk

“ron-tech whatsapp baileys modification”

Delayed code automatically follows a hardcoded WhatsApp channelForges viral forward badge with channel attribution
SHA-25665f3e11f059be90ecdd1d7d1847970478247ba76a49efe9d4e839c0b5f55cc93
URLhttps://registry.npmjs.org/@ostyado/baileys/-/baileys-2.0.8.tgz
MaleculeK(Li₃)O₈(IS₁₁As₄C₄CaDyLaXe₂)H₈(Cm₃₈Cr₉Db₄₀F₅MgOs₆Po₆Ti₂)Md₃(In₁₃Pa₁₆)

Also flagged by https://feeds.feedburner.com/TheHackersNews (101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent), osv (MAL-2026-17372: Malicious code in @ostyado/baileys (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.