MAL-2026-17678 Malicious code in @bellaxchuu/xbailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d07ffaff1ea6694d0579feba4090d61917939563b17e9395b875bb0c2aaf0b01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17345 Malicious code in @bellaxchuu/flowblue (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17346 Malicious code in @bellaxchuu/privatebails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17350 Malicious code in @bellaxchuu/xtrxbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17679 Malicious code in @bellaxchuu/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73138335788b7e9bb6c1df9db9ae6f82fa260c75d703ddfb850cba883c7d076 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17680 Malicious code in @bellaxchuu/yarnbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f991cf1a14df0cd0bbec0bd9340f983ea34dc98070e0e1c810e22653aecf469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/yarnbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f991cf1a14df0cd0bbec0bd9340f983ea34dc98070e0e1c810e22653aecf469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17675 Malicious code in @bellaxchuu/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6ca3e47d499dc50a641bc4c0d6c01228aa55dfcf76a4c8504680ce1dc1196e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6ca3e47d499dc50a641bc4c0d6c01228aa55dfcf76a4c8504680ce1dc1196e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17400 Malicious code in my-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17672 Malicious code in @xayz/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a9744aa6c5f3c994e66b4847aba63d6cf1503583f0a23185c67bb32b7394e77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17674 Malicious code in brat-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53137fe02a825bde6d844ec337cba590b1c454e97e52c2792358555eea1dd76b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17673 Malicious code in bottino-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f855c5c354d7a875b2e0c853f4fcfda7fb1033d5a89b21c4bdd3250412be984 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @itsmee_aizat.id/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 139f48c9c1d01563d5a815d23fde2f527dba3c31c7900f7e06776507cf5e687a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17670 Malicious code in @itsmee_aizat.id/baileys2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c95f98902ced2f03261621ba4cb5386a892bf31ac4510b916708d3d3eb21aa50 package.json declares "libsignal": "github:tenka-san/libsignal-node" as a runtime dependency. The source is a GitHub user account unrelated to the...

MAL-2026-17385 Malicious code in albert-anitabaileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in cantarella-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17371 Malicious code in @nyzzpediaa/baileys-new (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @dransay/address-validation (npm)

Source: ossf-package-analysis 82ababa5637b2f53f5087a161eeba1b6ca6ddba6d31ebb7842614bf0da119fa7 The OpenSSF Package Analysis project identified '@dransay/address-validation' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-17668 Malicious code in @dransay/address-validation (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using t...