MAL-2026-18824

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@elfhkry/baileys/MAL-2026-18824.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18824

Published

2026-10-27T00:00:00Z

Modified

2026-11-09T23:15:20Z

Summary

Malicious code in @elfhkry/baileys (npm)

Details

@elfhkry/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/socket.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/elf.json (the URL itself stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).

Update 2026-11-06: 8.0.11 and 8.0.12 also carry a second covert path. lib/Utils/messages-media.js (sha256 486a040f10373d4c2b365eb8c997ec295fef3878c01b6013be1f69b0536b371c) exports loadBase(n, q, groupAcceptInvite), which makeNewsletterSocket calls on every socket creation. 80 seconds later it fetches https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/ell.json (stored as base64) and sends QueryIds.FOLLOW for each id, then fetches invite codes from https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/GROUP.json (also base64) and calls groupAcceptInvite(code) for each, joining the account to WhatsApp groups chosen by the publisher. Errors are swallowed and nothing is logged. CyberXYZ read every published version statically from the npm registry tarballs on 2026-11-06 (integrity verified); nothing was executed. Amazon Inspector described the same loadBase loop in @rixxcodex/baileys (MAL-2026-16483).

Database specific

{
    "iocs": {
        "domains": [
            "raw.github.com",
            "raw.githubusercontent.com"
        ],
        "files": [
            {
                "digests": {
                    "sha256": "27a6c4dd46ae7dba325a3debc165bdd56ed629c00328855655484293e33afacd"
                },
                "paths": [
                    "lib/Socket/socket.js"
                ]
            },
            {
                "digests": {
                    "sha256": "3706e5d5afb20241629f61e265c3491eaccdeb6b79466d43eea6d2be52ca0952"
                },
                "paths": [
                    "lib/Socket/socket.js"
                ]
            },
            {
                "digests": {
                    "sha256": "486a040f10373d4c2b365eb8c997ec295fef3878c01b6013be1f69b0536b371c"
                },
                "paths": [
                    "lib/Utils/messages-media.js"
                ]
            }
        ],
        "ips": [],
        "urls": [
            "https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json",
            "https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/elf.json",
            "https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/ell.json",
            "https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/GROUP.json"
        ]
    }
}

References

Credits

- CyberXYZ - FINDER
- - https://cyberxyz.io

Affected packages

npm / @elfhkry/baileys

Package

Name: @elfhkry/baileys; View open source insights on deps.dev
Purl: pkg:npm/%40elfhkry/baileys

Affected ranges

Affected versions

8.*

8.0.11

8.0.12

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@elfhkry/baileys/MAL-2026-18824.json"