---
id: "MAL-2026-4619"
page: "https://infrastack.ai/live/MAL-2026-4619"
kind: "package"
aliases: ["MAL-2026-4619"]
title: "Malicious code in naileys (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "withdrawn"
category: "package"
products: [{"name": "naileys", "fixed": [], "affected": "= 0.5.2; = 0.5.1; = 0.5.4; = 0.5.6", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-05-20T12:27:33+00:00"
first_seen_at: "2026-11-09T23:38:05+00:00"
updated_at: "2026-11-09T23:47:53+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-4619", "first_seen_at": "2026-11-09T23:38:05+00:00"}]
exploit_sources: []
---

# Malicious code in naileys (npm)

Link for people: https://infrastack.ai/live/MAL-2026-4619 (this .md is for agents)

## Affected

- npm:naileys affected = 0.5.2; = 0.5.1; = 0.5.4; = 0.5.6 fixed no fixed version listed

## Timeline

- 2026-11-09T23:38:05+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-4619

## From the sources

naileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363392840803980@newsletter, 120363406068468165@newsletter, 120363407185712919@newsletter, 120363420514587725@newsletter, 120363426706961217@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (53307e8df479525765ddef8cf9a54dcf0aa368b8ef57a088b624a5e80f72c999)
naileys is a fork/lookalike of the WhatsApp library baileys (single-character edit; internal references still mention 'wileys', and fetchLatestBaileysVersion in lib/Utils/generics.js queries https://registry.npmjs.org/wileys). On every successful WhatsApp connection, lib/Socket/newsletter.js (lines 83-99) executes a hardcoded auto-follow routine: a comment 'Naileys - Auto follow channels on connect' precedes a CHANNELS array containing three hardcoded JIDs ('120363426706961217@newsletter', '120363406068468165@newsletter', '120363420514587725@newsletter') and issues newsletterWMexQuery(jid, QueryIds.FOLLOW) for each. This fires automatically when a consumer simply uses the advertised makeWASocket API — no opt-in, no documentation, no configuration. The effect is that every WhatsApp account driven by naileys (the developer's account or any bot/end-user account using their software) is silently subscribed to author-controlled newsletter channels, modifying installer-side account state and giving the author guaranteed broadcast reach to every consumer. This is the silent-relay pattern: the package's documented API has an undisclosed side effect routed to a hardcoded author destination. The name-similarity to baileys plus verbatim API mimicry corroborates intentional typosquat-as-delivery-vehicle.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_