MAL-2026-13930

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dreamguyxeon/baileyx/MAL-2026-13930.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13930

Published

2026-08-10T22:30:00Z

Modified

2026-08-14T15:00:55.659013336Z

Summary

Malicious code in @dreamguyxeon/baileyx (npm)

Details

npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and silently FOLLOWs listed newsletter JIDs. Trigger is runtime (makeNewsletterSocket), not install. It also fetches Baileys version metadata from DGXeon13/dgxeon-soket and aliases libsignal to npm:@dgxeon13/libsignal-node@1.0.0 (a separate package that patches @whiskeysockets/baileys). Independently corroborated by LPM Firewall's public malicious report for 2.0.0. Related OSV entries: dgxeon-baileys (MAL-2026-2252), baileys-dgxeon (MAL-2025-806). Tarball sha256 for 5.0.0: 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a)

This package is a fork of the Baileys WhatsApp library that contains an undocumented runtime hijack of the consumer's authenticated WhatsApp account. In lib/Socket/newsletter.js (lines 102-122), when the consumer creates a WhatsApp socket — the package's main advertised function — a 120-second setTimeout fires, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and for each newsletter ID in that list issues a QueryIds.FOLLOW request under the user's authenticated session. The list is hosted on a mutable main branch under the package author's GitHub account, so the author can rotate the targeted channels at any time post-publication without republishing the package. The behavior is not mentioned in the README and is not gated by any user prompt or configuration. The main entrypoint lib/index.js is additionally wrapped in a custom base91 string-table decoder with anti-debugger debugger statements and eval("this"), concealing the bootstrap edges from casual review. The package also aliases the security-critical libsignal dependency to the same author's scope (npm:@dreamguyxeon/libsignal-node@1.0.0), placing crypto primitives under the same trust boundary as the silent-relay code. Installer harm: any consumer who connects this fork to their WhatsApp account has their identity used to silently follow channels of the author's choosing, with the target list mutable indefinitely.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-13T15:26:42.818834673Z",
            "id": "IN-MAL-2026-017624",
            "sha256": "c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a",
            "modified_time": "2026-08-13T14:58:19Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017795",
            "import_time": "2026-08-14T14:51:39.063994671Z",
            "sha256": "7ea8f669b9d0f75975bc9b1dd420bbaaade523baf2ac1bd4bc335e6007e10aa4",
            "versions": [
                "3.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:37:23Z"
        },
        {
            "id": "IN-MAL-2026-017800",
            "import_time": "2026-08-14T14:51:39.399706035Z",
            "sha256": "9c19da8d5ae5dc169d9d584a1751cbc82ff809bf5d0866786805124a6993ecaa",
            "versions": [
                "2.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:38:18Z"
        },
        {
            "id": "IN-MAL-2026-017791",
            "import_time": "2026-08-14T14:51:38.811454662Z",
            "sha256": "a033f5d103d84f240ca1f414b8906b3fa9f5d734e475ae0855cb4940c0875575",
            "versions": [
                "4.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-14T14:36:44Z"
        },
        {
            "import_time": "2026-08-14T14:51:38.621336442Z",
            "id": "IN-MAL-2026-017788",
            "sha256": "a40a1f6133c242f2ddfbdfa05b03e50ec3f9995e0de10d3dcd6f75343b5924c9",
            "modified_time": "2026-08-14T14:36:20Z",
            "source": "amazon-inspector",
            "versions": [
                "5.0.0"
            ]
        }
    ],
    "iocs": {
        "urls": [
            "https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json",
            "https://raw.githubusercontent.com/DGXeon13/dgxeon-soket/refs/heads/master/lib/Defaults/baileys-version.json"
        ]
    }
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- pkgwarden - FINDER
- - https://pkgwarden.com

Affected packages

npm / @dreamguyxeon/baileyx

Package

Name: @dreamguyxeon/baileyx; View open source insights on deps.dev
Purl: pkg:npm/%40dreamguyxeon/baileyx

Affected ranges

Affected versions

1.*

1.0.0

2.*

2.0.0

3.*

3.0.0

4.*

4.0.0

5.*

5.0.0

Database specific

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "lib/Socket/newsletter.js",
            "tlsh": "c452965665fa5aa517a37054e67fb0e0b320f243782598673f8cd4020f4a1dde8b3bd8",
            "sha256": "d46c64f770bf6f1d7220deb9c9d38e842ba022b8cd95cda654705ba8297e9abb"
        },
        {
            "path": "lib/index.js",
            "tlsh": "5e1352c4ffcc7dbec1d01e731077055effa91f400adb9a40a2e16dd0ab9ab4651aa918",
            "sha256": "806b72da4e0047e5ee91e70676f14b1beea846996f6b45fe263a5963ef994c1a"
        },
        {
            "path": "package.json",
            "tlsh": "ff51ec25cc5cceb314c636e969ba0102907842534d95fc2c336c4bac4f5e25f72b9b2e",
            "sha256": "d7e464dba8b1c3a596ae06af6e6f1864cc39a7d71ceb7e198bfcd891d05d1e88"
        }
    ],
    "package_integrity": [
        {
            "filename": "baileyx-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-XfvM96uEUGK4anRfSTsqV3Q6DfNXUwQOzVlO/8wvjfRTrEgEgvsunFnUkZMf+t8EB/6KUHXPf9mOzSzIWGXEgw==",
                "sha1": "6cf0315ebd8912eb1f1d0bd95d662f353f5fd544"
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dreamguyxeon/baileyx/MAL-2026-13930.json"