MAL-2026-17326

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17326
Published
2026-09-25T15:37:42Z
Modified
2026-09-30T10:32:21Z
Summary
Malicious code in @zeronexcode/baileys (npm)
Details

makeWASocket() in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "4c05d85abdf76d1b7a0644a87264309e8db7756abf907eeea1dcd5660d23e014"
                },
                "note":  "Auto-follows channel 120363427099186895@newsletter on connect.",
                "paths":  [
                    "package/lib/Socket/index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ]
    }
}
Credits

Affected packages

npm / @zeronexcode/baileys

Package

Name
@zeronexcode/baileys
View open source insights on deps.dev
Purl
pkg:npm/%40zeronexcode/baileys

Affected ranges

Affected versions

7.*
7.0.0-zeronex.8

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json"