@xatancchii/natabaileys@1.2.5

Summary

The package is a fork of Baileys published under @xatancchii that remaps the libsignal import to a third-party scoped package via "libsignal": "npm:@bellaxchuu/libsignal-node@latest" in package.json. The scope @bellaxchuu matches neither the publisher of this package (@xatancchii) nor the upstream project (WhiskeySockets/libsignal-node), and the version is pinned to the mutable @latest dist-tag with no integrity check. The aliased dependency supplies the Signal protocol crypto primitives and is loaded on every require of the package through lib/Signal/libsignal.js and lib/Utils/crypto.js (SessionCipher / SessionBuilder / SessionRecord paths). Each npm install fetches whatever @bellaxchuu/libsignal-node currently publishes under @latest, and that code is executed in-process whenever the Baileys fork is imported, including from inside session handling for WhatsApp Web connections where decrypted message plaintext and long-lived session keys are available.

Source: amazon-inspector (262bd24b77d6bc63e4f9b139d3688b3956f85cd25b9b23613abc807841944578)