{"id":"MAL-2026-15820","summary":"Malicious code in @systemzero/baileys (npm)","details":"@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller's authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362)\nThis fork of Baileys wires an undocumented remote-control channel into makeWASocket, the package's main factory. On every socket construction it unconditionally opens a Server-Sent-Events connection to the hardcoded author endpoint https://zone.api.br/api/owner/whatsapp-signal-stream and keeps it alive with automatic reconnect/backoff. Incoming events named 'react' and 'follow' are executed against the installer's authenticated WhatsApp session by calling sock.newsletterReactMessage and sock.newsletterFollow with server-supplied newsletter JIDs, letting a remote author-controlled server cause the installer's account to follow channels and post reactions chosen by the operator of that server. Neither the endpoint nor the remote-controlled behavior is disclosed in the README or opt-in. A sibling helper hzxx.js hardcodes a specific newsletter JID (120363362355300503@newsletter, name 'shenvn.') and author contact metadata (telegram @blackhzx), consistent with a reach-padding operation driving installer identities toward author-selected channels.\n","modified":"2026-09-04T01:00:06.634562815Z","published":"2026-09-01T00:00:00Z","database_specific":{"iocs":{"urls":["https://zone.api.br/api/owner/whatsapp-signal-stream"]},"malicious-packages-origins":[{"sha256":"0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362","source":"amazon-inspector","versions":["1.1.2"],"id":"IN-MAL-2026-019394","import_time":"2026-09-04T00:45:55.480111482Z","modified_time":"2026-09-03T23:51:37Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@systemzero/baileys"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-13929"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-13932"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@systemzero/baileys/v/1.1.2"}],"affected":[{"package":{"name":"@systemzero/baileys","ecosystem":"npm","purl":"pkg:npm/%40systemzero/baileys"},"versions":["1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@systemzero/baileys/MAL-2026-15820.json","indicators":{"package_integrity":[{"filename":"baileys-1.1.2.tgz","hashes":{"sha512_sri":"sha512-knCs2uz7SA43EP6ot50qDogBRoqezJq1fSYZUj0Y2hQMP0zz1NDibbgjj00P1oT6cLEM9EHGii3rfnneZzYTLw==","sha1":"ee05b2c035fe2288542368b63cdbee6bd6eecf04"}}],"evidence_files":[{"path":"lib/Socket/index.js","sha256":"14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98","tlsh":"be21eeab5efb7537092764ee0e0f4116bb301b037749ec4876aca348df950248691eca"},{"path":"lib/Utils/signal-stream.js","sha256":"fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca","tlsh":"1161014a56f321610993b0a90b4fd10aa33ee103794ecd487f5cab045f86168ead2fce"},{"tlsh":"d482ff2a51b7292d4647b0793f9b74453134d01b4888bd29bf8c06ca9fcd68cbaf67d8","path":"lib/Socket/hzxx.js","sha256":"559ecfab41384f392c35bf07abb1dc797b967011773b6f8c3c2af212033454b8"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}