zero-baileys@3.6.0

Summary

zero-baileys is a fork of the Baileys WhatsApp Web library. Static keyword co-occurrence fired on lib/Utils/messages-media.js where require('child_process'), https.request, hostname, and POST all appear in the same file. In Baileys and its forks, messages-media.js handles media encryption/decryption and HTTP(S) uploads/downloads to WhatsApp's own media endpoints; child_process is used for optional ffmpeg/imagemagick invocation for media conversion. The keyword pattern is consistent with that documented functionality rather than with exfiltration: no specific installer-side data read (env, ~/.aws, ~/.ssh, ~/.npmrc, browser stores) is identified being sent to a non-first-party destination, and no install-time lifecycle hook or top-level side effect is present. No hardcoded attacker C2, no obfuscated destination, no credential-database or wallet enumeration, and no persistence artifact is observed. As a Baileys fork the package does carry the category-level concerns of that ecosystem (some forks have added covert side-effects such as auto-follow of author channels using the caller's session), but nothing of that shape is corroborated here.

Source: amazon-inspector (6f7a8aa73b2a3a5a61a45cc6f0ebeff58bfb23f8589895065fa30849421f4471)