MAL-2026-15919

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/megan-baileys/MAL-2026-15919.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-15919

Published

2026-09-03T18:09:54Z

Modified

2026-09-09T02:00:04Z

Summary

Malicious code in megan-baileys (npm)

Details

megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response is followed on the user's own authenticated WhatsApp session using the FOLLOW query id 7871414976211147. The follow list is therefore publisher-controlled at runtime, and the URL is hidden from a plaintext search. makeNewsletterSocket is reached from makeWASocket through lib/Socket/messages-send.js, so the behaviour fires for every consumer of the package with no opt-in. The base64 dead-drop and the follow loop are present in all ten published versions (1.0.0 through 1.0.11). No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. files.gifted.co.ke appears to be a file host used by a wider bot ecosystem and is deliberately not listed as an attacker domain. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b6f79c4488100adec664b913cf1be5e70d50ee21eb475e084a6413fb3559ada0)

The package's postinstall script walks up from its own install location into the consumer's node_modules directory, removes any existing @whiskeysockets/baileys directory there, and writes a replacement package.json whose main/exports point back into megan-baileys' own lib/index.mjs. After installation, any code in the installer's project — including transitive dependencies that legitimately declare @whiskeysockets/baileys — that calls require('@whiskeysockets/baileys') will silently load megan-baileys code instead of the genuine Baileys library published under the @whiskeysockets scope by a different maintainer. This is a dependency-tree hijack executed at install time via a lifecycle hook: the installer's declared dependency graph is mutated to substitute an unrelated author's code for a widely-used scoped package the installer never chose to replace.

Database specific

{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "c5fd93d838a136067d6bc89d5df6e2433cfa693ff13fe5fe44dc8bcd3a3c5180"
                },
                "note":  "base64-hidden dead-drop URL and forced follow loop (digest from 1.0.11)",
                "paths":  [
                    "lib/Socket/newsletter.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://files.gifted.co.ke/file/chJids.json"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019743",
            "import_time":  "2026-09-09T01:51:48.443112793Z",
            "modified_time":  "2026-09-09T01:34:00Z",
            "sha256":  "b6f79c4488100adec664b913cf1be5e70d50ee21eb475e084a6413fb3559ada0",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.8"
            ]
        },
        {
            "id":  "IN-MAL-2026-019741",
            "import_time":  "2026-09-09T01:51:48.167275608Z",
            "modified_time":  "2026-09-09T01:33:45Z",
            "sha256":  "19c1d78f034aa8ece4324fadb15747826d57cf021dafaedae403ab01784f3460",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.11"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- pkgwarden - FINDER
- - https://pkgwarden.com

Affected packages

npm / megan-baileys

Package

Name: megan-baileys; View open source insights on deps.dev
Purl: pkg:npm/megan-baileys

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.8

1.0.9

1.0.11

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files":  [
        {
            "path":  "scripts/postinstall.js",
            "sha256":  "7430605739a72957144a0326107a0564f44a9a961d2040db85c408f9a2d60c43",
            "tlsh":  "0b21e04309f343a59f3ca645f55c91491ed9cbb372136d30b08c67e11b822da24638aa"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "megan-baileys-1.0.8.tgz",
            "hashes":  {
                "sha1":  "ab5ea8466479db046ce61d0c9f140e5b9ba91929",
                "sha512_sri":  "sha512-lxZvKAgADmbakEr8LOxCzCsSnfbcWF/Wl2Lcc0ytJ5hOtqPDSvHLgtYI6SU6yIqrqly+WaDKXsw65KDWpC8aZg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/megan-baileys/MAL-2026-15919.json"