MAL-2026-19059

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zanxiky/baileys/MAL-2026-19059.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-19059

Published

2026-11-03T14:15:59Z

Modified

2026-11-10T05:30:04Z

Summary

Malicious code in @zanxiky/baileys (npm)

Details

Malicious package. @zanxiky/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated w:mex newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363399602691477@newsletter, 120363421563597486@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.

Database specific

{
    "iocs": {}
}

References

https://wormsign.io/portfolio/@zanxiky/baileys/

Credits

- wormsign - FINDER
- - https://x.com/w0rmsign

Affected packages

npm / @zanxiky/baileys

Package

Name: @zanxiky/baileys; View open source insights on deps.dev
Purl: pkg:npm/%40zanxiky%2Fbaileys

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.0.0-stage

1.*

1.1.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zanxiky/baileys/MAL-2026-19059.json"