{"id":"MAL-2026-19108","kind":"package","aliases":["MAL-2026-19108"],"related":[],"title":"Malicious code in raiden-baileys (npm)","description":"Malicious package. `raiden-baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363407277177688@newsletter, 120363407702752541@newsletter, 120363411769951302@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"raiden-baileys","note":"all versions","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T14:17:26+00:00","first_seen_at":"2026-11-11T04:25:25+00:00","triaged_at":"2026-11-11T04:26:23+00:00","updated_at":"2026-11-11T04:26:23+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19108':10A,13A '-2026':9A,12A '120363407277177688':62C '120363407702752541':64C '120363411769951302':66C '7871414976211147':47C 'attack':55C 'attacker-control':54C 'authent':39C 'auto':77C 'auto-follow':76C 'bailey':6A,23C,30C,69C 'baileys':16A 'channel':58C,73C 'code':2A 'connect':35C,80C 'control':56C 'everi':51C 'follow':43C,78C 'fork':27C 'hardcod':59C,71C 'id':46C 'issu':37C 'jid':61C,74C 'legitim':68C 'librari':32C 'mal':8A,11A 'malici':1A,17B,19C,85C 'mex':41C 'mutat':44C 'never':70C 'newslett':42C,60C,63C,65C,67C 'npm':7A 'packag':18B,20C 'publish':82C 'queri':45C 'raiden':5A,15A,22C 'raiden-bailey':4A,21C 'raiden-baileys':14A 'silent':49C 'subscrib':50C 'trojan':26C 'version':83C 'victim':52C 'w':40C 'whatsapp':31C,57C 'whiskeysockets/baileys':33C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["raidenbaileys"],"ptokens":["baileys","raiden"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19108':10A,13A '-2026':9A,12A 'bailey':6A 'baileys':16A 'code':2A 'mal':8A,11A 'malici':1A 'npm':7A 'raiden':5A,15A 'raiden-bailey':4A 'raiden-baileys':14A","search_b":"'malici':17B 'packag':18B","search_c":"'120363407277177688':62C '120363407702752541':64C '120363411769951302':66C '7871414976211147':47C 'attack':55C 'attacker-control':54C 'authent':39C 'auto':77C 'auto-follow':76C 'bailey':23C,30C,69C 'channel':58C,73C 'connect':35C,80C 'control':56C 'everi':51C 'follow':43C,78C 'fork':27C 'hardcod':59C,71C 'id':46C 'issu':37C 'jid':61C,74C 'legitim':68C 'librari':32C 'malici':19C,85C 'mex':41C 'mutat':44C 'never':70C 'newslett':42C,60C,63C,65C,67C 'packag':20C 'publish':82C 'queri':45C 'raiden':22C 'raiden-bailey':21C 'silent':49C 'subscrib':50C 'trojan':26C 'version':83C 'victim':52C 'w':40C 'whatsapp':31C,57C 'whiskeysockets/baileys':33C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T14:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19108","url":"https://osv.dev/vulnerability/MAL-2026-19108","severity":"critical","published_at":"2026-11-03T14:17:26+00:00","modified_at":"2026-11-11T04:15:05+00:00","first_seen_at":"2026-11-11T04:25:25+00:00","fetched_at":"2026-11-11T04:25:25+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}