Malicious code in shadowmd-baileys (npm)

shadowmd-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in shadowmd-baileys (npm)

shadowmd-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

baileyscrew (1.4.1), bintzge-baileys (>=2.0.2, <=2.0.3) +5 more potentially affected by unknown CVE via @alipclutch/libsignal-node (0.0.1-security)

@alipclutch/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @alipclutch/libsignal-node and may be impacted: - baileyscrew 1.4.1 - bintzge-baileys =2.0.2, =28.0.0, =1.0.0, =1.0.2, =8.6.46, =8.6.52 Source cves:...

baileyscrew (1.4.1), bintzge-baileys (>=2.0.2, <=2.0.3) +5 more potentially affected by unknown CVE via @alipclutch/libsignal-node (0.0.1-security)

@alipclutch/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @alipclutch/libsignal-node and may be impacted: - baileyscrew 1.4.1 - bintzge-baileys =2.0.2, =28.0.0, =1.0.0, =1.0.2, =8.6.46, =8.6.52 Source cves:...

baileyscrew (1.4.1), bintzge-baileys (>=2.0.2, <=2.0.3) +5 more potentially affected by unknown CVE via @alipclutch/libsignal-node (0.0.1-security)

@alipclutch/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @alipclutch/libsignal-node and may be impacted: - baileyscrew 1.4.1 - bintzge-baileys =2.0.2, =28.0.0, =1.0.0, =1.0.2, =8.6.46, =8.6.52 Source cves:...

shadowmd (8.6.87), shadowmd-baileys (>=8.6.49, <=8.6.91) potentially affected by unknown CVE via @shadowmd/libsignal-node (8.6.59)

@shadowmd/libsignal-node NPM version 8.6.59 is affected by a known vulnerability. The following packages have a transitive dependency on @shadowmd/libsignal-node and may be impacted: - shadowmd 8.6.87 - shadowmd-baileys =8.6.49, =8.6.91 Source cves: unknown CVE Source advisory:...