MAL-2026-18600: Malicious code in @ubedsockets/baileys (npm)
Malicious package. @ubedsockets/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated w:mex newsletter FOLLOW mutation (queryid 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363410154606795@newsletter, 120363423295236859@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.
Affected Software
Event History
Frequently Asked Questions
Who is affected by this package?
Any application that installs and connects using any published version of npm/@ubedsockets/baileys is affected. The malicious behavior runs on connection and subscribes the connected WhatsApp account to attacker-controlled newsletters.
Does this require a non-default option or explicit application action?
No special configuration or application action is described. The package performs the authenticated newsletter FOLLOW mutation when it connects.
How can I determine whether this package is present in my environment?
Check dependencies and lockfiles for npm/@ubedsockets/baileys. Static analysis can also identify the injected subscription code, including a w:mex FOLLOW mutation using query_id 7871414976211147 and the hardcoded newsletter JIDs 120363410154606795@newsletter and 120363423295236859@newsletter.
Is there a safe published version of this package to upgrade to?
No. All published versions of npm/@ubedsockets/baileys are described as malicious.