Skip to content
OpenAdvisories
Malicious MAL-2026-18861

@langitdeveloper/baileys

npm package · versions 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.9, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6

Reported Oct 27, 2026 · Updated Nov 9, 2026

If this package is installed

Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.

Details

@langitdeveloper/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363418090359162@newsletter, 120363426930096454@newsletter and a list downloaded at runtime from https://raw.githubusercontent.com/FadelSM/IDCH/refs/heads/main/idch.json, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).

Indicators of compromise

Shown defanged and not clickable. Search any indicator to find other packages using it.

Domains

URLs

  • hxxps://raw[.]githubusercontent[.]com/FadelSM/IDCH/refs/heads/main/idch[.]json other packages →