megan-baileys

{"schema_version":"1.7.4","id":"MAL-2026-15919","published":"2026-09-03T18:09:54Z","modified":"2026-09-09T01:53:40.010984489Z","summary":"Malicious code in megan-baileys (npm)","details":"megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response is followed on the user's own authenticated WhatsApp session using the FOLLOW query id 7871414976211147. The follow list is therefore publisher-controlled at runtime, and the URL is hidden from a plaintext search. makeNewsletterSocket is reached from makeWASocket through lib/Socket/messages-send.js, so the behaviour fires for every consumer of the package with no opt-in. The base64 dead-drop and the follow loop are present in all ten published versions (1.0.0 through 1.0.11). No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. files.gifted.co.ke appears to be a file host used by a wider bot ecosystem and is deliberately not listed as an attacker domain. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6f79c4488100adec664b913cf1be5e70d50ee21eb475e084a6413fb3559ada0)\nThe package's postinstall script walks up from its own install location into the consumer's node_modules directory, removes any existing `@whiskeysockets/baileys` directory there, and writes a replacement `package.json` whose `main`/`exports` point back into megan-baileys' own `lib/index.mjs`. After installation, any code in the installer's project — including transitive dependencies that legitimately declare `@whiskeysockets/baileys` — that calls `require('@whiskeysockets/baileys')` will silently load megan-baileys code instead of the genuine Baileys library published under the @whiskeysockets scope by a different maintainer. This is a dependency-tree hijack executed at install time via a lifecycle hook: the installer's declared dependency graph is mutated to substitute an unrelated author's code for a widely-used scoped package the installer never chose to replace.\n","affected":[{"package":{"name":"megan-baileys","ecosystem":"npm"},"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.8","1.0.9","1.0.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"7430605739a72957144a0326107a0564f44a9a961d2040db85c408f9a2d60c43","tlsh":"0b21e04309f343a59f3ca645f55c91491ed9cbb372136d30b08c67e11b822da24638aa"}],"package_integrity":[{"filename":"megan-baileys-1.0.8.tgz","hashes":{"sha1":"ab5ea8466479db046ce61d0c9f140e5b9ba91929","sha512_sri":"sha512-lxZvKAgADmbakEr8LOxCzCsSnfbcWF/Wl2Lcc0ytJ5hOtqPDSvHLgtYI6SU6yIqrqly+WaDKXsw65KDWpC8aZg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/megan-baileys"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-15819"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-13932"},{"type":"WEB","url":"https://pkgwarden.com/incidents/baileys-whatsapp-auto-follow-npm-september-2026/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/megan-baileys/v/1.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/megan-baileys/v/1.0.11"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"c5fd93d838a136067d6bc89d5df6e2433cfa693ff13fe5fe44dc8bcd3a3c5180"},"note":"base64-hidden dead-drop URL and forced follow loop (digest from 1.0.11)","paths":["lib/Socket/newsletter.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://files.gifted.co.ke/file/chJids.json"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-019743","import_time":"2026-09-09T01:51:48.443112793Z","modified_time":"2026-09-09T01:34:00Z","sha256":"b6f79c4488100adec664b913cf1be5e70d50ee21eb475e084a6413fb3559ada0","source":"amazon-inspector","versions":["1.0.8"]},{"id":"IN-MAL-2026-019741","import_time":"2026-09-09T01:51:48.167275608Z","modified_time":"2026-09-09T01:33:45Z","sha256":"19c1d78f034aa8ece4324fadb15747826d57cf021dafaedae403ab01784f3460","source":"amazon-inspector","versions":["1.0.11"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}