Skip to content
OpenAdvisories
Malicious MAL-2026-18600

@ubedsockets/baileys

npm package · versions 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.7.0, 1.7.1, 1.7.10, 1.7.11, 1.7.12, 1.7.2, 1.7.3, 1.7.5, 1.7.6, 1.7.7, 1.7.9

Reported Nov 2, 2026 · Updated Nov 4, 2026

If this package is installed

Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.

Details

Malicious package. `@ubedsockets/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363410154606795@newsletter, 120363423295236859@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.