@alannxd/baileys

One or more suspicious static signals were detected.

Importing lib/index.js; invoking socket.checkBan(number).

Consumer IP/usage metadata is disclosed on import; supplied WhatsApp phone numbers are disclosed to the third-party host.

Import-time beacon and third-party phone-number transmission.

At module import, the package contacts a maintainer-controlled remote URL solely to display update information. Separately, its exported checkBan helper places the caller's phone number in a request URL to xzc-corporation.biz.id, an endpoint unrelated to WhatsApp, with a suspicious nonstandard header. This is concrete disclosure of user-supplied personal data to an undisclosed third party.

Source inspection confirms unsolicited import-time networking and a public helper that exfiltrates caller-supplied phone numbers to an unrelated host. The install hook itself is benign, but it does not mitigate the runtime disclosure.