gehneb@1.0.1

package.json declares `"consolefy": "git+https://github.com/ccndjdjdnnddnd-jpg/sbdrsfhbrfh.git"` instead of resolving the legitimate `consolefy` package from the npm registry. The git URL has no commit SHA, tag, or branch pin, so `npm install` clones whatever HEAD points to at install time — fully mutable by the owner of that throwaway GitHub account (random-character username, unrelated to the legitimate consolefy publisher). The package's library entry (`lib/index.js`) transitively loads `lib/Classes/Client.js` and `lib/Classes/CommandHandler.js`, both of which `require("consolefy")` at module top level, so any code the attacker pushes to that repo executes on every installer that requires gehneb. Combined signals: empty `description` and empty `author` metadata, short opaque package name, and a Baileys/WhatsApp-bot dependency surface re-published under unrelated branding. The unpinned-attacker-repo override alone provides a silent install-time/require-time RCE channel into the installer's environment.