MAL-2026-19055

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vanzky/baileys/MAL-2026-19055.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19055
Published
2026-11-02T16:11:56Z
Modified
2026-11-10T00:00:06Z
Summary
Malicious code in @vanzky/baileys (npm)
Details

Malicious package. @vanzky/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363412479307951@newsletter, 120363413713776550@newsletter, 120363429868081610@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.

Database specific 
{
    "iocs": {}
}
References
Credits

Affected packages

npm / @vanzky/baileys

Package

Name
@vanzky/baileys
View open source insights on deps.dev
Purl
pkg:npm/%40vanzky%2Fbaileys

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.0.0-stage
1.*
1.0.0
1.0.1
1.0.2
1.0.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vanzky/baileys/MAL-2026-19055.json"