Affected: npm: @zeronexcode/baileys

makeWASocket() in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ed77130bf7a34aa77306ff8a654c0d51e2c2b68153849d89c100d13430322f88) This fork of the Baileys WhatsApp library adds an undocumented behavior to its makeWASocket wrapper: on every connection.update event where the connection reaches 'open', it calls sock.newsletterFollow on a hardcoded newsletter JID (120363427099186895@newsletter), subscribing the installer's authenticated WhatsApp account to an author-controlled newsletter with no disclosure and no opt-out. The action fires under the installer's WhatsApp identity as a side effect of using the library's core socket API. Upstream Baileys does not perform this action. No credential theft, environment scraping, remote code execution, filesystem persistence, or data exfiltration is present; the ping/GET pattern flagged in lib/Utils/generics.js is a benign latency/keepalive helper. The observed harm is covert reach-padding under the installer's identity rather than material compromise of the installer's data or host.

## Source: ghsa-malware (5dd9996269bfb2b5ea9c5310fed819139eaf2b663e740fc8be34052da1128e4e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be r…

Affected: npm: @zanta/baileys

This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.

`package/lib/Socket/socket.js` line 23 declares the plain-literal `AUTO_FOLLOW_CHANNEL_JID = "120363406265537739@newsletter"`; lines 769-794, in the login-success (`CB:success`) handler, wait 3 seconds after the connection opens and send a FOLLOW query (`xwa2_newsletter_join_v2`) for it (cited line 774: `QueryIds.FOLLOW,`), suppressing "already subscribed" errors. There is no opt-out. The package README describes the fork as one from which "annoying developer auto-follow newsletter scripts have been completely stripped", which the shipped code contradicts.

Line numbers refer to version 1.0.1; the same code is present in every published version listed under `affected`.

Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys' stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the v…

Affected: npm: baileys-xbats

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.

The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.

The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Affected package: baileys-xbats (npm),…

Affected: npm: alipclutch-baileys

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed) This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode(...) with a decimal-byte array that decodes to the hardcoded host https://fiora.nixel.my.id/ and issues network requests to it from within the message-send path. The destination is obfuscated (reconstructed from a char-code array rather than appearing as a plain URL literal) and is unrelated to WhatsApp's own infrastructure, so on normal use of the send API caller-side message data is diverted to a third-party endpoint controlled by the package author. The obfuscation of the destination, its placement inside the core send path of a WhatsApp automation library, and the lack of any documented purpose for that host are consistent with covert exfiltration/relay of message traffic using the installer's authenticated session.

## Source: ghsa-malware (09e5b87da389cf9d1ea5964b0bd5f22a4ac0dab50847448dc1352158633f09f1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious s…

Affected: npm: @wenzyx1/bails

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.

The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.

The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Affected package: @wenzyx1/bails (npm)…

Affected: npm: @wanzlonely/bails4u

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.

The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.

The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Affected package: @wanzlonely/bails4u…

Affected: npm: @sanzoffc/baileys

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4393cd98419ed1fce683c0fde038bce830873769d85d69e64674df61f68502bc) This package is a fork of the Baileys WhatsApp library that adds covert remote-controlled behavior driven by the installer's authenticated WhatsApp session. In lib/Socket/socket.js, socketConnect() (invoked from validateConnection on every WebSocket open) reconstructs a URL from a String.fromCharCode char-code array that resolves to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, fetches that JSON list, and iterates it to issue WhatsApp GraphQL mutations with query_id 7871414976211147 (newsletter subscribe/follow) for each id in the remote-supplied list. The list is hosted on a mutable personal-GitHub branch controlled by a third party, so whoever edits that file determines which actions the installer's WhatsApp account performs. A second helper (generateMessageV) base64+XOR-decodes (key 23) a hardcoded '@newsletter' JID and pairs it with the same query_id 7871414976211147, then schedules the same subscription action 40 seconds after invocation - layered string obfuscation of a fixed destination JID that has no legitimate purpose in a WhatsApp protocol library. The behavior is not documented, not caller-configurable, and the URL and JID are deliberately obfuscated to evade string scanners. The manifest additionally declares '@whiskeysockets/eslint-config' as an unpinned github: sou…

Affected: npm: @sakataoffc/baileys

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.

The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.

The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Affected package: @sakataoffc/baileys…

Affected: npm: @sairidev/baileys-new

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.

The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.

The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Affected package: @sairidev/baileys-ne…

Affected: npm: @saazkira/baileys

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.

The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.

The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Affected package: @saazkira/baileys (n…