Malicious code in @badzz88/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17341 Malicious code in @badzz88/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious Package

Overview @badzz88/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@badzz88/baileys (8.5.8), @sakataoffc/baileys (>=5.0.1, <=6.0.0) potentially affected by unknown CVE via @vnxsync/libsignal-node (0.0.1-security)

@vnxsync/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @vnxsync/libsignal-node and may be impacted: - @badzz88/baileys 8.5.8 - @sakataoffc/baileys =5.0.1, =6.0.0 Source cves: unknown CVE Source advisory:...

@badzz88/baileys (8.5.8), @sakataoffc/baileys (>=5.0.1, <=6.0.0) potentially affected by unknown CVE via @vnxsync/libsignal-node (0.0.1-security)

@vnxsync/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @vnxsync/libsignal-node and may be impacted: - @badzz88/baileys 8.5.8 - @sakataoffc/baileys =5.0.1, =6.0.0 Source cves: unknown CVE Source advisory:...