MAL-2026-16104

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab) @nexustechpro/baileys is a fork of the WhatsApp library `baileys` in which lib/Socket/chats.js (~270 KB) is heavily obfuscated (obfuscator.io-style rotating string-array decoder, hex-escaped import specifiers such as '\x40\x63\x61\x63\x68\x65\x61\x62\x6c\x65\x2f\x6e\x6f\x64\x65\x2d\x63\x61\x63\x68\x65', integer-arithmetic control flow, unicode identifier names, ~2772-entry string array) while every sibling file in lib/Socket/ (groups.js, messages-recv.js, socket.js, registration.js) remains readable JavaScript and the upstream whiskeysockets/baileys ships this file unobfuscated. The obfuscated module is reachable from the package entry point (lib/index.js) and sits directly in the code path that handles WhatsApp session state (authState credentials, Signal identity keys, noise keys, signed pre-keys). package.json additionally declares `"whatsapp-rust-bridge": "latest"`, a floating unpinned tag on a non-upstream dependency, which allows that dependency's publisher to ship arbitrary code (including install lifecycle scripts) into every installer of this package on any future install with no version pin or integrity check.