Suspicious ^86% javascript Download

@nyzzpediaa/baileys-new 1.0.9

preinstall hook, typosquat name

“WhatsApp Web multi-device API — maintained by Nyzzpedia”

Prepare hook decodes and executes an opaque commandForges viral forward badge with channel attribution

SHA-2567f06da27e80e510c28e934aa33f614dd804cd6269861a21d4fd98098cdb8d857

URLhttps://registry.npmjs.org/@nyzzpediaa/baileys-new/-/baileys-new-1.0.9.tgz

MaleculeK(Li₃)O₈(IS₉As₄C₄Ca₂DyLaXe)H₉(Cm₃₇Cr₉Db₄₂F₉MgOs₆Po₆Ti₃U)Md₄(In₁₃Pa₁₇Pt₃)

Also flagged by https://feeds.feedburner.com/TheHackersNews (101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent), osv (MAL-2026-17371: Malicious code in @nyzzpediaa/baileys-new (npm)) +4 more.

Evidence

Telegram service name dugong.js · lines 1–14

1:11… dugonggg", ah dejavu (r)
2// tanggal 14 agustus 2025 makassar
3// telegram: @tskiofc & @kyuucode
4
5const WAProto = require('../../WAProto').proto;
6const crypto = require('crypto');
7const Utils_1 = require("../Utils");
8
9class kikyy {
10    constructor(utils, waUploadToServer, relayMessageFn) {
11        this.utils = utils;
12        this.relayMessage = relayMessageFn
13        this.waUploadToServer = waUploadToServer;
14   …

Sets extreme WhatsApp forwarding-score literal dugong.js · lines 308–318

8…          },    
              participant: "[email protected]",
              remoteJid: "status@broadcast",
              forwardingScore: 99999,
              isForwarded: true,
              mentionedJid: [jid],
⋯5 lines

Hardcoded channel JID in message metadata dugong.js · lines 321–332

27… Disclosure: true,
              },
          };
324
          img.message.forwardedNewsletterMessageInfo = {
              newsletterJid: "120363423893248023@newsletter",
              serverMessageId: 1,
              newsletterName: `Nyzz Market Official   [ TESTI ]   √`,
⋯4 lines

Forwarded WhatsApp newsletter metadata dugong.js · lines 388–398

6…                        participant: jid,
                          remoteJid: "status@broadcast",
                          forwardedNewsletterMessageInfo: {
                              newsletterName: "Nyzz",
                              newsletterJid: "120363423893248023@newsletter",
⋯6 lines

Baileys makeWASocket socket factory index.js · lines 63–82

63:52… lt": mod };
64};
65
66Object.defineProperty(exports, "__esModule", { value: true });
67exports.makeWASocket = void 0;
68
69const Socket_1 = __importDefault(require("./Socket"));
70
71exports.makeWASocket = Socket_1.default;
72
73__exportStar(require("../WAProto"), exports);
74__exportStar(require("./Utils"), exports);
75__exportStar(require("./Types"), exports);
76__exportStar(require("./Store"), exports);
77__exportStar(require("./Defaults"), exports);
78__exportStar(require("./WABinary"), exports);
79__exportStar(require("./WAM"), exports);
80__exportStar(require("./WAUSync"), exports);
81
82exports.default = Socket_1.default;

Showing the top 5 files — 7 more files (91 regions) not shown.

No evidence locations were recorded for this file. Raw result