dzyhaxz-baileys@1.1.1

Summary

dzyhaxz-baileys is a fork of the Baileys WhatsApp library that, on every WhatsApp connection.open event, silently calls sock.newsletterFollow for a hardcoded channel ID 120363411407993897@newsletter with autoFollowChannels defaulting to true. The README explicitly states 'No hidden auto-follow: Channel operations (sock.newsletterFollow) are strictly explicit', directly contradicting the shipped behavior — any application built on this library causes its WhatsApp-authenticated users to follow the author's channel without consent. Separately, package.json aliases the Signal protocol crypto library to an author-owned package via a mutable dist-tag: "libsignal": "npm:dzyhaxz-libsignal@latest", with no version pin. The aliased module provides the ECDH curve primitives used by lib/Utils/crypto.js for WhatsApp end-to-end key agreement, and md5/hkdf are additionally re-exported from the author-controlled @rexxhayanasi/wangcap-id-bridge. Each install resolves whatever bytes the publisher currently points latest at. The auto-follow uses the installer's WhatsApp identity for reach-padding (no credential theft, no RCE, no account takeover), and the aliased crypto dependency has not been observed to contain malicious bytes in this version — but the combination is a deceptive cover-story and a weaponizable supply-chain shape.

Source: amazon-inspector (03631e9889407ee8976e020933fa6984bd173c9a5de6b7a89ba7a5629437e705)