{"id":"MAL-2026-16281","summary":"Malicious code in @sanzoffc/baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4393cd98419ed1fce683c0fde038bce830873769d85d69e64674df61f68502bc)\nThis package is a fork of the Baileys WhatsApp library that adds covert remote-controlled behavior driven by the installer's authenticated WhatsApp session. In lib/Socket/socket.js, socketConnect() (invoked from validateConnection on every WebSocket open) reconstructs a URL from a String.fromCharCode char-code array that resolves to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, fetches that JSON list, and iterates it to issue WhatsApp GraphQL mutations with query_id 7871414976211147 (newsletter subscribe/follow) for each id in the remote-supplied list. The list is hosted on a mutable personal-GitHub branch controlled by a third party, so whoever edits that file determines which actions the installer's WhatsApp account performs. A second helper (generateMessageV) base64+XOR-decodes (key 23) a hardcoded '@newsletter' JID and pairs it with the same query_id 7871414976211147, then schedules the same subscription action 40 seconds after invocation - layered string obfuscation of a fixed destination JID that has no legitimate purpose in a WhatsApp protocol library. The behavior is not documented, not caller-configurable, and the URL and JID are deliberately obfuscated to evade string scanners. The manifest additionally declares '@whiskeysockets/eslint-config' as an unpinned github: source and pins most other dependencies to '*', widening the resolution trust boundary.\n","modified":"2026-09-18T04:45:05.476048196Z","published":"2026-09-18T04:29:33Z","database_specific":{"malicious-packages-origins":[{"versions":["3.0.4"],"id":"IN-MAL-2026-020178","import_time":"2026-09-18T04:43:03.710609626Z","modified_time":"2026-09-18T04:29:33Z","sha256":"4393cd98419ed1fce683c0fde038bce830873769d85d69e64674df61f68502bc","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sanzoffc/baileys/v/3.0.4"}],"affected":[{"package":{"name":"@sanzoffc/baileys","ecosystem":"npm","purl":"pkg:npm/%40sanzoffc/baileys"},"versions":["3.0.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sanzoffc/baileys/MAL-2026-16281.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"baileys-3.0.4.tgz","hashes":{"sha512_sri":"sha512-prWbJsDnAnMsugsWjA9VR0Kx7JQ5y0y87ze+VO1sGwll/kBIsTvkQI7lMiq6/0SWDs5GJAIr77A8BHCg72G5JQ==","sha1":"b1b8fe6ee997780989e23290233629da98dca16d"}}],"evidence_files":[{"tlsh":"ffd2b41b46f3053aab777476562b6021333580073a48dca57bac8254af8e778e6e77cc","path":"lib/Socket/socket.js","sha256":"ea57a6770cf2c246e27a5ffe85ffeb496624f9b1582868d5dff184fd6369a394"},{"path":"package.json","sha256":"c133372660768c7345c90deac3371900a7ee0879d56082fd6f6f40fd7ea605f7","tlsh":"f541ee21cfae4d3314da2585e9a5900265a809f3be487c2c7394967c4f4e25f27be8ed"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}