wa-tunnel

wa-tunnel - TCP Tunneling through Whatsapp This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts. This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social...

Malicious code in @ubedsockets/baileys (npm)

Malicious package. @ubedsockets/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. On connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

Malicious code in @vanzxy/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8aaf0ab3d240dca86b7e0bb0385dfb39a4aad4f3a0a44e21fb77b5b14e580862 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @lynnidoffc/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 584ca35ead2d625e43abb6c62f640a80d53d817703f10758bd62d25343d72721 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18520 Malicious code in luna-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c01b0a941a0a3f23bc5c66bbc9e6cd9f3fae9c6f367d05a99b1abec64175e85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17366 Malicious code in @levvicode/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malware in @maulenv/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18473 Malicious code in @maulenv/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4066bb598c01797163001810f75881d142c70779cfd6ef6b9bd838d7ce3c6e88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @levvicode/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @levvicode/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @maulenv/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4066bb598c01797163001810f75881d142c70779cfd6ef6b9bd838d7ce3c6e88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@mrlegendbot/baileys (>=1.0.0, <=1.2.7) potentially affected by unknown CVE via @mrlegendbot/libsignal-node (1.1.0)

@mrlegendbot/libsignal-node NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @mrlegendbot/libsignal-node and may be impacted: - @mrlegendbot/baileys =1.0.0, =1.2.7 Source cves: unknown CVE Source advisory: GHSA-2G3Q-XXV2-VH4P...

@mrlegendbot/baileys (>=1.0.0, <=1.2.7) potentially affected by unknown CVE via @mrlegendbot/libsignal-node (1.1.0)

@mrlegendbot/libsignal-node NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @mrlegendbot/libsignal-node and may be impacted: - @mrlegendbot/baileys =1.0.0, =1.2.7 Source cves: unknown CVE Source advisory: OSV:MAL-2026-18474...

Malware in @mrlegendbot/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @nuxzofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a17042e445631051160d83e41511f46995e3b5323b625a2a52aa260d12ccbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18467 Malicious code in @nuxzofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a17042e445631051160d83e41511f46995e3b5323b625a2a52aa260d12ccbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @nuxzofficial/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @axo_cuy/baileys (npm)

Source: amazon-inspector 0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48 package.json declares a hard dependency libsignal with the source github:tenka-san/libsignal-node. This is an off-registry dependency source: npm install resolves it to the current HEAD of that third-party...

Malicious code in @bil-rgb/baileys (npm)

Source: amazon-inspector 3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f package.json for @bil-rgb/[email protected] declares its libsignal dependency as github:tenka-san/libsignal-node with no commit SHA, no tag, and no integrity check. npm install resolves this value by cloning...

Malicious code in @axo_cuy/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48 package.json declares a hard dependency libsignal with the source github:tenka-san/libsignal-node. This is an off-registry dependency source: npm...