{"id":"MAL-2026-17374","kind":"package","aliases":["MAL-2026-17374"],"related":[],"title":"Malicious code in @rennnpm/baileys (npm)","description":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @rennnpm/baileys (npm), version(s): 1.0.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1147bf0a20408ab406838da0e6aa5a2086deb1afe6651013a6081714ada641ff)\npackage.json declares the `libsignal` dependency as `github:tenka-san/libsignal-node`, a bare GitHub reference to a personal user's fork with no commit SHA, tag, or version constraint. On `npm install`, npm clones the default branch's current HEAD and runs any lifecycle scripts the fetched repository declares, executing that code on the installer's machine with no integrity check. Whoever controls the `tenka-san/libsignal-node` repository can change the code at any time, and every installer of this package will run whatever is at HEAD at that moment. The upstream `@whiskeysockets/baileys` package resolves `libsignal` from the npm registry at a pinned version; substituting a mutable third-party git reference in this fork replaces a registry-integrity-checked dependency with an unpinned attacker-controllable code source.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@rennnpm/baileys","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T13:25:19+00:00","first_seen_at":"2026-10-29T14:24:36+00:00","triaged_at":"2026-10-29T14:25:47+00:00","updated_at":"2026-10-29T14:30:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17374':8A,11A '-2026':7A,10A '/libsignal-node':273C,330C '1.0.0':248C '100':23C '1147bf0a20408ab406838da0e6aa5a2086deb1afe6651013a6081714ada641ff':262C '2026':28C '7871414976211147':67C 'abus':212C 'account':91C 'across':116C 'action':47C,211C 'affect':242C 'amazon':260C 'amazon-inspector':259C 'anoth':154C 'arbitrari':239C 'array':132C 'ask':96C 'attack':73C,143C,227C,390C 'attacker-chosen':72C 'attacker-control':142C,226C,389C 'authent':60C,83C,217C 'bailey':36C 'bare':275C 'base64':123C,125C 'branch':299C 'casual':106C 'chang':162C,333C 'channel':45C,93C,229C 'channel-subscript':44C 'channel/newsletter':76C 'char':130C 'char-cod':129C 'check':323C,384C 'chosen':74C 'clone':296C 'code':2A,57C,131C,241C,314C,335C,392C 'commit':286C 'connect':54C,184C,194C 'constraint':291C 'control':144C,228C,325C,391C 'covert':43C 'credenti':234C 'current':301C 'declar':264C,311C 'default':298C 'depend':267C,385C 'detail':251C 'differ':206C 'edit':254C 'encod':124C 'establish':235C 'even':195C 'everi':170C,340C 'execut':238C,312C 'exfiltr':233C 'famili':22C,118C,174C 'fetch':139C,309C 'fire':187C 'follow':63C,189C 'fork':33C,208C,283C,378C 'gain':221C 'git':374C 'github':152C,269C,276C 'head':302C,350C 'hidden':104C 'host':155C 'id':66C 'ident':32C 'identifi':24C 'inject':41C,56C 'inspector':261C 'instal':80C,164C,214C,294C,317C,341C 'instead':138C 'integr':322C,383C 'issu':58C 'jid':77C,101C,150C,200C 'join':98C 'json/js':146C 'larg':21C 'layer':52C 'let':158C 'librari':39C 'libsign':266C,359C 'lifecycl':306C 'line':257C 'list':147C,161C 'liter':122C 'machin':319C 'mal':6A,9A 'malici':1A,13B,210C 'mechan':179C 'method':205C 'mex':62C 'moment':353C 'mutabl':141C,370C 'name':199C 'near':31C 'near-ident':30C 'never':95C 'new':167C 'npm':5A,168C,245C,293C,295C,362C 'obfusc':113C 'obfuscation/delivery':204C 'observ':115C 'one':69C,110C 'packag':14B,16C,198C,243C,344C,357C 'package.json':263C 'part':18C 'parti':373C 'per':207C,249C 'persist':236C 'person':280C 'pin':366C 'plain':120C 'publish':169C 'queri':64C,65C,190C 'reach':222C 'reconstruct':133C 'refer':277C,375C 'registri':363C,382C 'registry-integrity-check':381C 'remot':145C,240C 'rennnpm/baileys':4A,12A,244C 'replac':379C 'repositori':310C,331C 'resolv':358C 'review':108C 'routin':185C 'run':304C,346C 'runtim':135C,157C 'sampl':171C 'san':272C,329C 'script':307C 'second':192C 'septemb':27C 'session':85C,219C 'sever':112C 'sha':287C 'share':175C 'silent':86C 'socket':51C,183C 'socket-connect':182C 'sourc':107C,250C,258C,393C 'string':121C 'subscrib':87C,224C 'subscript':46C 'substitut':368C 'tag':288C 'target':100C,149C,160C 'techniqu':114C 'tenka':271C,328C 'tenka-san':270C,327C 'third':372C 'third-parti':371C 'though':196C 'time':338C 'under':178C 'unpin':388C 'upstream':355C 'use':78C 'user':281C 'valu':201C 'variant':137C 'version':246C,290C,367C 'via':109C 'victim':89C 'w':61C 'web':38C 'whatev':347C 'whatsapp':37C,50C,75C,84C,218C 'whiskeysockets/baileys':356C 'whoever':324C 'without':165C 'wrapped/patched':181C 'xor':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T13:25:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17374","url":"https://osv.dev/vulnerability/MAL-2026-17374","severity":"critical","published_at":"2026-10-29T13:25:19+00:00","modified_at":"2026-10-29T13:48:10+00:00","first_seen_at":"2026-10-29T14:24:36+00:00","fetched_at":"2026-10-29T14:24:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}