{"id":"MAL-2026-17326","summary":"Malicious code in @zeronexcode/baileys (npm)","details":"makeWASocket() in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it.","modified":"2026-09-30T10:32:21.686828086Z","published":"2026-09-25T15:37:42Z","database_specific":{"iocs":{"files":[{"paths":["package/lib/Socket/index.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"4c05d85abdf76d1b7a0644a87264309e8db7756abf907eeea1dcd5660d23e014"},"note":"Auto-follows channel 120363427099186895@newsletter on connect."}]}},"affected":[{"package":{"name":"@zeronexcode/baileys","ecosystem":"npm","purl":"pkg:npm/%40zeronexcode/baileys"},"versions":["7.0.0-zeronex.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json"}}],"schema_version":"1.9.0","credits":[{"name":"smiling-hyena","contact":["smilinghyena4@gmail.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}