If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Malicious package. `@zhengliyoux/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363430894218102@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.