MAL-2026-19059: Malicious code in @zanxiky/baileys (npm)
Malicious package. @zanxiky/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated w:mex newsletter FOLLOW mutation (queryid 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363399602691477@newsletter, 120363421563597486@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (0f1051c395438db8dc0dbe6de1cb09e6e10c83fc6062d359ca85093ce946f0e0) package.json for @zanxiky/baileys@1.1.0 declares the libsignal dependency as github:tenka-san/libsignal-node — a non-registry git source on an unaffiliated personal GitHub account with no commit SHA and no integrity check. On npm install, npm clones the current default-branch tip of that repository and executes any lifecycle scripts it contains, so the owner of the tenka-san GitHub account controls arbitrary code execution on every installer's machine, and the referenced bytes can change at any time without any version bump to this package. The GitHub account is unrelated to the upstream Baileys publisher (whiskeysockets), and the fork itself appears to be a lookalike of the Baileys WhatsApp library.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the malicious connection behavior?
Any deployment using @zanxiky/baileys is exposed, because all published versions are reported as malicious. The behavior occurs when the client connects and silently follows the two hardcoded WhatsApp newsletter JIDs.
Can installation itself execute attacker-controlled code?
For @zanxiky/baileys@1.1.0, yes. Its package manifest declares libsignal from an unaffiliated GitHub repository without a commit SHA or integrity check, so npm installs the current default-branch tip and can execute lifecycle scripts from that repository.
How can I check whether a package instance contains the injected behavior?
Confirm whether @zanxiky/baileys is present; all of its published versions are malicious. Static inspection can look for the w:mex newsletter FOLLOW mutation using query_id 7871414976211147 or the hardcoded JIDs 120363399602691477@newsletter and 120363421563597486@newsletter.