{"id":"MAL-2026-17362","kind":"package","aliases":["MAL-2026-17362"],"related":[],"title":"Malicious code in @kelvdra/baileys (npm)","description":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @kelvdra/baileys (npm), version(s): 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (96f3f702084444337d5c3a9bc2b0945ecb49960a49e01008f2b3d381664310ba)\npackage.json declares `libsignal` as `github:Kelvdra/libsignal` — an off-registry, mutable git source with no commit SHA, no version pin, and no integrity check. On `npm install`, npm fetches whatever the referenced GitHub tree contains at that moment and installs it, executing any lifecycle scripts (preinstall/install/postinstall/prepare) the fetched repository declares. Whoever controls the `Kelvdra/libsignal` repository controls arbitrary code execution on the installer's machine at install time. The dependency name `libsignal` also mirrors the well-known WhatsApp/Signal library commonly consumed via the Baileys ecosystem, but resolution is redirected to an author-owned GitHub tree rather than a pinned registry release. The static `ping` rule hit in lib/Utils/generics.js is a keyword co-occurrence in an ID/version generation helper and does not itself indicate exfiltration.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@kelvdra/baileys","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-01T17:02:55+00:00","first_seen_at":"2026-10-29T14:24:36+00:00","triaged_at":"2026-10-29T14:25:47+00:00","updated_at":"2026-10-29T18:53:19+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17362':8A,11A '-2026':7A,10A '1.0.5':251C '1.0.6':248C,250C '100':23C '2026':28C '7871414976211147':67C '96f3f702084444337d5c3a9bc2b0945ecb49960a49e01008f2b3d381664310ba':266C 'abus':212C 'account':91C 'across':116C 'action':47C,211C 'affect':242C 'also':338C 'amazon':264C 'amazon-inspector':263C 'anoth':154C 'arbitrari':239C,323C 'array':132C 'ask':96C 'attack':73C,143C,227C 'attacker-chosen':72C 'attacker-control':142C,226C 'authent':60C,83C,217C 'author':359C 'author-own':358C 'bailey':36C,350C 'base64':123C,125C 'casual':106C 'chang':162C 'channel':45C,93C,229C 'channel-subscript':44C 'channel/newsletter':76C 'char':130C 'char-cod':129C 'check':290C 'chosen':74C 'co':380C 'co-occurr':379C 'code':2A,57C,131C,241C,324C 'commit':282C 'common':346C 'connect':54C,184C,194C 'consum':347C 'contain':301C 'control':144C,228C,318C,322C 'covert':43C 'credenti':234C 'declar':268C,316C 'depend':335C 'detail':255C 'differ':206C 'ecosystem':351C 'edit':258C 'encod':124C 'establish':235C 'even':195C 'everi':170C 'execut':238C,308C,325C 'exfiltr':233C,392C 'famili':22C,118C,174C 'fetch':139C,295C,314C 'fire':187C 'follow':63C,189C 'fork':33C,208C 'gain':221C 'generat':385C 'git':278C 'github':152C,271C,299C,361C 'helper':386C 'hidden':104C 'hit':373C 'host':155C 'id':66C 'id/version':384C 'ident':32C 'identifi':24C 'indic':391C 'inject':41C,56C 'inspector':265C 'instal':80C,164C,214C,293C,306C,328C,332C 'instead':138C 'integr':289C 'issu':58C 'jid':77C,101C,150C,200C 'join':98C 'json/js':146C 'kelvdra/baileys':4A,12A,244C 'kelvdra/libsignal':272C,320C 'keyword':378C 'known':343C 'larg':21C 'layer':52C 'let':158C 'lib/utils/generics.js':375C 'librari':39C,345C 'libsign':269C,337C 'lifecycl':310C 'line':261C 'list':147C,161C 'liter':122C 'machin':330C 'mal':6A,9A 'malici':1A,13B,210C 'mechan':179C 'method':205C 'mex':62C 'mirror':339C 'moment':304C 'mutabl':141C,277C 'name':199C,336C 'near':31C 'near-ident':30C 'never':95C 'new':167C 'npm':5A,168C,245C,292C,294C 'obfusc':113C 'obfuscation/delivery':204C 'observ':115C 'occurr':381C 'off-registri':274C 'one':69C,110C 'own':360C 'packag':14B,16C,198C,243C 'package.json':267C 'part':18C 'per':207C,253C 'persist':236C 'pin':286C,366C 'ping':371C 'plain':120C 'preinstall/install/postinstall/prepare':312C 'publish':169C 'queri':64C,65C,190C 'rather':363C 'rc.1':249C 'rc.3':252C 'reach':222C 'reconstruct':133C 'redirect':355C 'referenc':298C 'registri':276C,367C 'releas':368C 'remot':145C,240C 'repositori':315C,321C 'resolut':353C 'review':108C 'routin':185C 'rule':372C 'runtim':135C,157C 'sampl':171C 'script':311C 'second':192C 'septemb':27C 'session':85C,219C 'sever':112C 'sha':283C 'share':175C 'silent':86C 'socket':51C,183C 'socket-connect':182C 'sourc':107C,254C,262C,279C 'static':370C 'string':121C 'subscrib':87C,224C 'subscript':46C 'target':100C,149C,160C 'techniqu':114C 'though':196C 'time':333C 'tree':300C,362C 'under':178C 'use':78C 'valu':201C 'variant':137C 'version':246C,285C 'via':109C,348C 'victim':89C 'w':61C 'web':38C 'well':342C 'well-known':341C 'whatev':296C 'whatsapp':37C,50C,75C,84C,218C 'whatsapp/signal':344C 'whoever':317C 'without':165C 'wrapped/patched':181C 'xor':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":"developers","plain_action":null,"first_public_at":"2026-10-01T17:02:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17362","url":"https://osv.dev/vulnerability/MAL-2026-17362","severity":"critical","published_at":"2026-10-01T17:02:55+00:00","modified_at":"2026-10-29T13:48:10+00:00","first_seen_at":"2026-10-29T14:24:36+00:00","fetched_at":"2026-10-29T14:24:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}