MAL-2026-19072

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yshtxxproject/baileys/MAL-2026-19072.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-19072

Published

2026-11-03T14:16:42Z

Modified

2026-11-10T07:00:40Z

Summary

Malicious code in @yshtxxproject/baileys (npm)

Details

Malicious package. @yshtxxproject/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated w:mex newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363403764263127@newsletter, 120363413797603665@newsletter, 120363421563597486@newsletter, 120363423614575184@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.

Database specific

{
    "iocs": {}
}

References

https://wormsign.io/portfolio/@yshtxxproject/baileys/

Credits

- wormsign - FINDER
- - https://x.com/w0rmsign

Affected packages

npm / @yshtxxproject/baileys

Package

Name: @yshtxxproject/baileys; View open source insights on deps.dev
Purl: pkg:npm/%40yshtxxproject%2Fbaileys

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.0.0-stage

0.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@yshtxxproject/baileys/MAL-2026-19072.json"