zero-baileys@2.7.0

Summary

package.json redirects the libsignal dependency to npm:@otaxayun/libsignal-node@latest. The @latest dist-tag is mutable and unpinned, so each npm install of zero-baileys resolves whatever tarball the @otaxayun scope currently publishes and executes any lifecycle scripts (preinstall/install/postinstall) it contains. Upstream Baileys resolves libsignal from a pinned source; the alias here substitutes an unofficial third-party scope as the trust root for a core cryptographic dependency, with no version pin and no integrity check. The static match on child_process + https.request + POST in lib/Utils/messages-media.js:28 corresponds to media-download helpers in the runtime library and is not itself an install-time exfil path.

Source: amazon-inspector (58d472a4390be835fc8ffd5e62a7d3b2bb7270ad6ea651d9cd15bc7abd7735c8)