@DANZXCODE/DANZX-BAIL · MAL-2026-18816 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Oct 27, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
@danzxcode/danzx-bail is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/socket.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json (the URL itself stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).
Update 2026-11-06: a second covert path, in 9.0.5, 9.0.6 and 9.0.7. lib/Utils/messages-media.js exports loadBase, which makeNewsletterSocket (lib/Socket/newsletter.js) calls on every socket creation as loadBase(newsletterWMexQuery, QueryIds). 80 seconds later it fetches a channel list from a URL stored as base64 and, 5 seconds apart, calls newsletterWMexQuery(id, QueryIds.FOLLOW) for each entry, swallowing errors and logging nothing. 9.0.5 and 9.0.6: lib/Utils/messages-media.js sha256 b41905238c3feaad4f8eae25b8cd7acea4ae94ec0916e404d9baadc2a49575fd, URL https://ch-danzx.vercel.app/lyyn. 9.0.7: sha256 cc4da072e185d0312ea0fb7ea0d08edbde8645b6a0218759dca8ab011a85ad59, URL https://danzx-bail.vercel.app/lyyn. 9.0.5 has only this path, so it is added to the affected versions. CyberXYZ read every published version statically from the npm registry tarballs on 2026-11-06 (integrity verified); nothing was executed. Amazon Inspector described the same loadBase loop in @rixxcodex/baileys (MAL-2026-16483).
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.