Vulnerability MAL-2026-19072
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 days ago
November 03, 2026 at 02:16 PM UTC
Malicious code in @yshtxxproject/baileys (npm)
0.0.0-stage - 0.0.1
0.0.0-stage - 0.0.1
Summary
Malicious code in @yshtxxproject/baileys (npm)
Details
Malicious package. @yshtxxproject/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated w:mex newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363403764263127@newsletter, 120363413797603665@newsletter, 120363421563597486@newsletter, 120363423614575184@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.
References
Impacted packages
Timeline
Published
6 days ago
November 03, 2026 at 02:16 PM UTC
Last Modified
2 hours ago
November 10, 2026 at 07:00 AM UTC