MAL-2026-16199

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/plogme/MAL-2026-16199.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16199
Published
2026-09-08T00:00:00Z
Modified
2026-09-16T01:15:05Z
Summary
Malicious code in plogme (npm)
Details

plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys (MAL-2026-15917), and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js (javascript-obfuscator output, identical to the file in MAL-2026-15917) hardcodes the publisher's WhatsApp newsletter channels 120363423670814885@newsletter and 120363402922206865@newsletter and exports followCrysnovaxTrustedChannels(); lib/Socket/socket.js invokes it from the connection.update handler, so the user's own authenticated WhatsApp account silently follows both channels on every successful connection, with no opt-out. lib/Utils/integrity.js hashes hostname, platform, arch, cpu model and Node version into a machine fingerprint and POSTs it with the package identity to https://bailey.crysnovax.link/api/v1/verify on every socket connect. The obfuscated follow module was decoded, not executed.

Database specific 
{
    "iocs": {
        "domains": [
            "bailey.crysnovax.link"
        ],
        "files": [
            {
                "digests": {
                    "sha256": "ee0dc4f66c39603e12b014cc09bee260bb80b9bbfe3d2f1428faccf95bebfec3"
                },
                "note": "javascript-obfuscator-processed forced-follow module, identical to MAL-2026-15917 (digest from 1.0.0 and 1.0.3)",
                "paths": [
                    "lib/Utils/channel-policy.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "c55caba2bdf737f29b600fddc87392eab1de8c9f6626afb4225c028b40841814"
                },
                "note": "machine-fingerprint POST to bailey.crysnovax.link on every connect (digest from 1.0.3)",
                "paths": [
                    "lib/Utils/integrity.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "d6ad429de0e0723c2f19e38c197feb28f60e62526bff155a8da26d52353f66c6"
                },
                "note": "connection.update hook that invokes the forced follow, identical to MAL-2026-15917 (digest from 1.0.0 and 1.0.3)",
                "paths": [
                    "lib/Socket/socket.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ],
        "urls": [
            "https://bailey.crysnovax.link/api/v1/verify"
        ]
    }
}
References
Credits

Affected packages

npm / plogme

Package

Name
plogme
View open source insights on deps.dev
Purl
pkg:npm/plogme

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/plogme/MAL-2026-16199.json"