Hostile 92% javascript Download

lilys-baileys 1.3.3

preinstall hook, auto-join, impersonation

“Whatsapp baileys coded by Fallzx-Coderid.”

Delayed code automatically follows a hardcoded WhatsApp channelForges viral forward badge with channel attribution
SHA-2567740bf67508d62c241bf68a2635b1c37b95dfe67e83c741fdcdc9d5c0ed1ee2f
URLhttps://registry.npmjs.org/lilys-baileys/-/lilys-baileys-1.3.3.tgz
MaleculeK(Li₃)O₈(IS₁₀As₄C₄Ca₂DyLaXe)H₉(Cm₃₉Cr₈Db₄₀F₅MgOs₆Po₆Ti₂U)Md₅(In₁₄Pa₁₇Pt)

Also flagged by https://feeds.feedburner.com/TheHackersNews (101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent), osv (MAL-2026-17398: Malicious code in lilys-baileys (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.