Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

shadowmd (8.6.87), shadowmd-baileys (>=8.6.49, <=8.6.57) potentially affected by unknown CVE via @shadowmd/libsignal-node (8.6.59)

@shadowmd/libsignal-node NPM version 8.6.59 is affected by a known vulnerability. The following packages have a transitive dependency on @shadowmd/libsignal-node and may be impacted: - shadowmd 8.6.87 - shadowmd-baileys =8.6.49, =8.6.57 Source cves: unknown CVE Source advisory:...