{"id":"MAL-2026-15918","summary":"Malicious code in @modss/baileys (npm)","details":"@modss/baileys is a renamed fork of the Baileys WhatsApp Web library published 2026-09-01 and 2026-09-02 under a scope created the same day. lib/Socket/newsletter.js sets NEWSLETTER_LIST_URL to https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json. On every connection.update with connection === 'open', autoFollowConfiguredNewsletters() fetches that list and issues an executeWMexQuery FOLLOW for each id on the user's own authenticated WhatsApp session, caching followed ids in session/followed-newsletters.json. An Indonesian comment in the file explains that the list lives on GitHub so channels can be added or removed without redeploying the code, i.e. the follow targets are publisher-controlled at runtime. All three published versions carry the identical handler. The package also aliases its libsignal dependency to @modss/libsignal, which pkgwarden read as a plain rename with no malicious content. No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys) and MAL-2026-13932 (my-auto-follow).","modified":"2026-09-04T06:15:05.332455304Z","published":"2026-09-03T18:09:54Z","database_specific":{"iocs":{"urls":["https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"935e65a1525ca7d4b11ca19d4aed36f92fd99dd9ddd20aca295f92134892f46c"},"note":"runtime dead-drop fetch and forced follow loop (digest from 1.0.2)","paths":["lib/Socket/newsletter.js"]}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@modss/baileys"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-15819"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-13932"},{"type":"WEB","url":"https://pkgwarden.com/incidents/baileys-whatsapp-auto-follow-npm-september-2026/"}],"affected":[{"package":{"name":"@modss/baileys","ecosystem":"npm","purl":"pkg:npm/%40modss/baileys"},"versions":["1.0.0","1.0.1","1.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@modss/baileys/MAL-2026-15918.json"}}],"schema_version":"1.9.0","credits":[{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}