@yudzxml/baileys@7.4.2

Summary

This package is a fork of the Baileys WhatsApp Web library. a static rule matched on keyword co-occurrence in lib/Utils/messages-media.js: require('child_process'), require('os'), require('http')/require('https'), and POST/GET/fetch( calls, with the only cited literal URL being https://mmg.whatsapp.net (WhatsApp's own media server, which is the expected destination for a Baileys media utility). The evidence quotes do not name any non-first-party attacker endpoint, do not show environment-variable scraping, and do not show reads of installer-secret paths (~/.ssh, ~/.aws, ~/.npmrc, browser stores). The primitive co-occurrence in messages-media.js is the shape you would expect from a legitimate WhatsApp media upload/download implementation (child_process for ffmpeg/thumbnail generation, http/https/fetch for WhatsApp media endpoints, os for tmpdir). Because this is a fork of a widely used upstream library, and forks are a common vehicle for covert modifications (e.g., undocumented actions using the caller's WhatsApp session), a reviewer should diff this fork against upstream Baileys to confirm messages-media.js only talks to mmg.whatsapp.net/WhatsApp infrastructure, and that no other file in the package performs credential harvest, undocumented auto-follow/subscribe, or exfiltration using the caller's session. Without corroborating evidence of installer harm, keyword co-occurrence alone is not sufficient to publish a block.

Source: amazon-inspector (629ff06ada2390b75e4ba41304b30289746455bba454c455d04d7743f6998974)