@ubedsockets/baileys

{"modified":"2026-11-02T15:50:08Z","schema_version":"1.7.4","id":"MAL-2026-18600","summary":"Malicious code in @ubedsockets/baileys (npm)","details":"Malicious package. `@ubedsockets/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363410154606795@newsletter, 120363423295236859@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.","affected":[{"package":{"ecosystem":"npm","name":"@ubedsockets/baileys","purl":"pkg:npm/%40ubedsockets%2Fbaileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.1","1.7.10","1.7.11","1.7.12","1.7.2","1.7.3","1.7.5","1.7.6","1.7.7","1.7.9"]}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/@ubedsockets/baileys/"}],"credits":[{"name":"wormsign","type":"FINDER","contact":["https://x.com/w0rmsign"]}],"database_specific":{"iocs":{}}}