Suspicious 86% javascript Download

@sakataoffc/baileys 3.0.0

Unofficial fork, evasion features

“A WebSockets library for interacting with WhatsApp Web”

Delayed code automatically follows a hardcoded WhatsApp channelForges viral forward badge with channel attribution
SHA-256f64da5c05b03107699df1ffc809bd947e8ac7bde67cb9e8fe0641e6cbb86e741
URLhttps://registry.npmjs.org/@sakataoffc/baileys/-/baileys-3.0.0.tgz
MaleculeK₂(AmLi₂)O₁₀(I₃ErS₈As₈C₆Ca₂DyLaPrXe₂)H₈(Cm₄₇Cr₁₀Db₄₈F₁₀MgOs₈Po₈Ti₃)Md₆(BkIn₁₂Pa₁₁Pt)

Also flagged by https://feeds.feedburner.com/TheHackersNews (101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent), osv (MAL-2026-17379: Malicious code in @sakataoffc/baileys (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.