MAL-2026-16483 Malicious code in @rixxcodex/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b5247e2f10d09b51e8d59c4b36cb2cbe62909af4be588fdb07dabf0afabcf2 This package is a fork of the Baileys WhatsApp library that adds three undocumented channels which use the installer's authenticated WhatsApp session...

Malicious code in libas-signal (npm)

Source: amazon-inspector eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25 On require of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter.js with a modified copy. The injected code...

Malicious code in my-auto-follow (npm)

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...

Malicious code in @shinzepelly/libsignal-node (npm)

Source: amazon-inspector 957954ced5e6fb2e8ab6a666adf496ca2edc7575a4e202b593d6698b5d89809f Package impersonates the legitimate libsignal-node library description copied verbatim: "Open Whisper Systems' libsignal for Node.js" under an unrelated scope. On require, index.js schedules install.js, whic...

Malicious code in saturn-bail (npm)

Source: amazon-inspector 9a29ae44bbeeb4d31d176d78d669615e7a508bd236620cc3724478100f9b6997 saturn-bail is a Baileys-derivative WhatsApp library that, on every makeWASocket call, schedules a 90-second timer which executes newsletterWMexQuery"120363329486691279@newsletter", QueryIds.FOLLOW against t...