{"id":"MAL-2026-18824","kind":"package","aliases":["MAL-2026-18824"],"related":[],"title":"Malicious code in @elfhkry/baileys (npm)","description":"@elfhkry/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/socket.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/elf.json (the URL itself stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).\n\nUpdate 2026-11-06: 8.0.11 and 8.0.12 also carry a second covert path. lib/Utils/messages-media.js (sha256 486a040f10373d4c2b365eb8c997ec295fef3878c01b6013be1f69b0536b371c) exports loadBase(n, q, groupAcceptInvite), which makeNewsletterSocket calls on every socket creation. 80 seconds later it fetches https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/ell.json (stored as base64) and sends QueryIds.FOLLOW for each id, then fetches invite codes from https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/GROUP.json (also base64) and calls groupAcceptInvite(code) for each, joining the account to WhatsApp groups chosen by the publisher. Errors are swallowed and nothing is logged. CyberXYZ read every published version statically from the npm registry tarballs on 2026-11-06 (integrity verified); nothing was executed. Amazon Inspector described the same loadBase loop in @rixxcodex/baileys (MAL-2026-16483).","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@elfhkry/baileys","fixed":[],"affected":"= 8.0.11; = 8.0.12","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T00:00:00+00:00","first_seen_at":"2026-11-09T23:37:51+00:00","triaged_at":"2026-11-09T23:39:36+00:00","updated_at":"2026-11-09T23:39:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-06':99C,188C '-11':98C,187C '-16483':205C '-17342':95C '-18824':8A,11A '-2026':7A,10A,94C,204C '/fhkryy/fhkry/refs/heads/main/elf.json':67C '/fhkryy/fhkry/refs/heads/main/ell.json':131C '/fhkryy/fhkry/refs/heads/main/group.json':148C '/skyzopedia/newsletterid/refs/heads/main/vip_push.json,':64C '2026':97C,186C '486a040f10373d4c2b365eb8c997ec295fef3878c01b6013be1f69b0536b371c':111C '8.0.11':100C '8.0.12':102C '80':124C 'account':33C,159C 'also':103C,149C 'amazon':194C 'array':76C 'authent':81C 'bailey':21C 'base64':134C,150C 'behaviour':88C 'call':119C,152C 'carri':104C 'channel':36C 'charact':74C 'character-cod':73C 'chosen':37C,163C 'code':2A,45C,75C,144C,154C 'connect':44C 'covert':107C 'creation':123C 'cyberxyz':174C 'describ':196C 'download':58C 'elfhkry/baileys':4A,12A,15C 'error':167C 'everi':121C,176C 'execut':193C 'export':112C 'famili':92C 'fetch':128C,142C 'follow':53C 'fork':18C 'group':162C 'groupacceptinvit':116C,153C 'id':140C 'inspector':195C 'instal':29C 'integr':189C 'invit':143C 'join':157C 'later':126C 'lib/socket/socket.js':47C 'lib/utils/messages-media.js':109C 'librari':24C 'list':57C 'loadbas':113C,199C 'log':173C 'loop':200C 'makenewslettersocket':118C 'mal':6A,9A,93C,203C 'malici':1A,13B 'mex':52C 'n':114C 'noth':171C,191C 'npm':5A,182C 'packag':14B 'path':108C 'phantomsub':91C 'publish':40C,166C,177C 'q':115C 'queri':54C 'queryids.follow':137C 'raw.github.com':63C 'raw.github.com/skyzopedia/newsletterid/refs/heads/main/vip_push.json,':62C 'raw.githubusercontent.com':66C,130C,147C 'raw.githubusercontent.com/fhkryy/fhkry/refs/heads/main/elf.json':65C 'raw.githubusercontent.com/fhkryy/fhkry/refs/heads/main/ell.json':129C 'raw.githubusercontent.com/fhkryy/fhkry/refs/heads/main/group.json':146C 'read':175C 'registri':183C 'rixxcodex/baileys':202C 'runtim':60C 'second':106C,125C 'send':48C,136C 'session':82C 'sha256':110C 'silent':26C 'socket':43C,122C 'static':179C 'store':71C,132C 'subscrib':27C 'swallow':169C 'tarbal':184C 'tell':85C 'updat':96C 'url':69C 'use':77C 'verifi':190C 'version':178C 'victim':79C 'w':51C 'web':23C 'whatsapp':22C,32C,35C,50C,161C 'without':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["baileys"],"ptokens":["baileys","elfhkry"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-18824':8A,11A '-2026':7A,10A 'code':2A 'elfhkry/baileys':4A,12A 'mal':6A,9A 'malici':1A 'npm':5A","search_b":"'malici':13B 'packag':14B","search_c":"'-06':99C,188C '-11':98C,187C '-16483':205C '-17342':95C '-2026':94C,204C '/fhkryy/fhkry/refs/heads/main/elf.json':67C '/fhkryy/fhkry/refs/heads/main/ell.json':131C '/fhkryy/fhkry/refs/heads/main/group.json':148C '/skyzopedia/newsletterid/refs/heads/main/vip_push.json,':64C '2026':97C,186C '486a040f10373d4c2b365eb8c997ec295fef3878c01b6013be1f69b0536b371c':111C '8.0.11':100C '8.0.12':102C '80':124C 'account':33C,159C 'also':103C,149C 'amazon':194C 'array':76C 'authent':81C 'bailey':21C 'base64':134C,150C 'behaviour':88C 'call':119C,152C 'carri':104C 'channel':36C 'charact':74C 'character-cod':73C 'chosen':37C,163C 'code':45C,75C,144C,154C 'connect':44C 'covert':107C 'creation':123C 'cyberxyz':174C 'describ':196C 'download':58C 'elfhkry/baileys':15C 'error':167C 'everi':121C,176C 'execut':193C 'export':112C 'famili':92C 'fetch':128C,142C 'follow':53C 'fork':18C 'group':162C 'groupacceptinvit':116C,153C 'id':140C 'inspector':195C 'instal':29C 'integr':189C 'invit':143C 'join':157C 'later':126C 'lib/socket/socket.js':47C 'lib/utils/messages-media.js':109C 'librari':24C 'list':57C 'loadbas':113C,199C 'log':173C 'loop':200C 'makenewslettersocket':118C 'mal':93C,203C 'mex':52C 'n':114C 'noth':171C,191C 'npm':182C 'path':108C 'phantomsub':91C 'publish':40C,166C,177C 'q':115C 'queri':54C 'queryids.follow':137C 'raw.github.com':63C 'raw.github.com/skyzopedia/newsletterid/refs/heads/main/vip_push.json,':62C 'raw.githubusercontent.com':66C,130C,147C 'raw.githubusercontent.com/fhkryy/fhkry/refs/heads/main/elf.json':65C 'raw.githubusercontent.com/fhkryy/fhkry/refs/heads/main/ell.json':129C 'raw.githubusercontent.com/fhkryy/fhkry/refs/heads/main/group.json':146C 'read':175C 'registri':183C 'rixxcodex/baileys':202C 'runtim':60C 'second':106C,125C 'send':48C,136C 'session':82C 'sha256':110C 'silent':26C 'socket':43C,122C 'static':179C 'store':71C,132C 'subscrib':27C 'swallow':169C 'tarbal':184C 'tell':85C 'updat':96C 'url':69C 'use':77C 'verifi':190C 'version':178C 'victim':79C 'w':51C 'web':23C 'whatsapp':22C,32C,35C,50C,161C 'without':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18824","url":"https://osv.dev/vulnerability/MAL-2026-18824","severity":"critical","published_at":"2026-10-27T00:00:00+00:00","modified_at":"2026-11-09T23:15:20+00:00","first_seen_at":"2026-11-09T23:37:51+00:00","fetched_at":"2026-11-09T23:37:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}