Skip to content
OpenAdvisories
Malicious MAL-2026-18877

@rakku-kun/baileys

npm package · versions 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.2, 2.0.22, 2.0.23, 2.0.24, 2.0.26, 2.0.27, 2.0.31, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9

Reported Oct 27, 2026 · Updated Nov 9, 2026

If this package is installed

Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.

Details

@rakku-kun/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363406005175144@newsletter, 12036421453095412@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).