{"id":"MAL-2026-16199","summary":"Malicious code in plogme (npm)","details":"plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys (MAL-2026-15917), and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js (javascript-obfuscator output, identical to the file in MAL-2026-15917) hardcodes the publisher's WhatsApp newsletter channels 120363423670814885@newsletter and 120363402922206865@newsletter and exports followCrysnovaxTrustedChannels(); lib/Socket/socket.js invokes it from the connection.update handler, so the user's own authenticated WhatsApp account silently follows both channels on every successful connection, with no opt-out. lib/Utils/integrity.js hashes hostname, platform, arch, cpu model and Node version into a machine fingerprint and POSTs it with the package identity to https://bailey.crysnovax.link/api/v1/verify on every socket connect. The obfuscated follow module was decoded, not executed.","modified":"2026-09-16T01:15:05.445182771Z","published":"2026-09-08T00:00:00Z","database_specific":{"iocs":{"domains":["bailey.crysnovax.link"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"ee0dc4f66c39603e12b014cc09bee260bb80b9bbfe3d2f1428faccf95bebfec3"},"note":"javascript-obfuscator-processed forced-follow module, identical to MAL-2026-15917 (digest from 1.0.0 and 1.0.3)","paths":["lib/Utils/channel-policy.js"]},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"c55caba2bdf737f29b600fddc87392eab1de8c9f6626afb4225c028b40841814"},"note":"machine-fingerprint POST to bailey.crysnovax.link on every connect (digest from 1.0.3)","paths":["lib/Utils/integrity.js"]},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"d6ad429de0e0723c2f19e38c197feb28f60e62526bff155a8da26d52353f66c6"},"note":"connection.update hook that invokes the forced follow, identical to MAL-2026-15917 (digest from 1.0.0 and 1.0.3)","paths":["lib/Socket/socket.js"]}],"urls":["https://bailey.crysnovax.link/api/v1/verify"]}},"references":[{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-15917"},{"type":"WEB","url":"https://pkgwarden.com/incidents/baileys-whatsapp-auto-follow-npm-september-2026/"}],"affected":[{"package":{"name":"plogme","ecosystem":"npm","purl":"pkg:npm/plogme"},"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/plogme/MAL-2026-16199.json"}}],"schema_version":"1.9.0","credits":[{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}