Vulnerability MAL-2026-19055
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 days ago
November 02, 2026 at 04:11 PM UTC
Malicious code in @vanzky/baileys (npm)
0.0.0-stage - 1.0.2 and 1.0.4
0.0.0-stage - 1.0.2 and 1.0.4
Summary
Malicious code in @vanzky/baileys (npm)
Details
Malicious package. @vanzky/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363412479307951@newsletter, 120363413713776550@newsletter, 120363429868081610@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.
References
Impacted packages
Timeline
Published
7 days ago
November 02, 2026 at 04:11 PM UTC
Last Modified
3 hours ago
November 10, 2026 at 12:00 AM UTC