Suspicious 86% javascript Download

@revizahoshii/baileys 0.5.2

preinstall hook, young package

“Fork Baileys milik Reviza — pesan interaktif, album, newsletter, auto-follow saluran, dan panggilan suara (VoIP).”

WhatsApp library fork silently follows a channel on connectWhatsApp library fork hardcodes a channel JID
SHA-256f7a645498a92009084238daf339404eed0e62a95ea2d96b6095ec4e3af0d1b8c
URLhttps://registry.npmjs.org/@revizahoshii/baileys/-/baileys-0.5.2.tgz
MaleculeK₂(AmLi₂)O₉(S₉AlAs₁₃C₅Ca₂Dy₂I₃LaXe₃)H₁₀(Cm₅₀Cr₈Db₅₂F₁₂HfMgOs₁₀Po₁₅Ti₃U₆)Md₅(BkIn₁₀Pa₁₃Pt₃)

Also flagged by https://feeds.feedburner.com/TheHackersNews (101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent), osv (MAL-2026-17375: Malicious code in @revizahoshii/baileys (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.