Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller's authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362)

This fork of Baileys wires an undocumented remote-control channel into makeWASocket, the package's main factory. On every socket construction it unconditionally opens a Server-Sent-Events connection to the hardcoded author endpoint https://zone.api.br/api/owner/whatsapp-signal-stream and keeps it alive with automatic reconnect/backoff. Incoming events named 'react' and 'follow' are executed against the installer's authenticated WhatsApp session by calling sock.newsletterReactMessage and sock.newsletterFollow with server-supplied newsletter JIDs, letting a remote author-controlled server cause the installer's account to follow channels and post reactions chosen by the operator of that server. Neither the endpoint nor the remote-controlled behavior is disclosed in the README or opt-in. A sibling helper hzxx.js hardcodes a specific newsletter JID (120363362355300503@newsletter, name 'shenvn.') and author contact metadata (telegram @blackhzx), consistent with a reach-padding operation driving installer identities toward author-selected channels.

Source: ghsa-malware (0e6f79378a7549e346c76671b64b14201cf6ba6b3675d32031a20789b69f3d7a)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.