{"id":"MAL-2026-19108","summary":"Malicious code in raiden-baileys (npm)","details":"Malicious package. `raiden-baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363407277177688@newsletter, 120363407702752541@newsletter, 120363411769951302@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","modified":"2026-11-11T04:15:05.495656773Z","published":"2026-11-03T14:17:26Z","database_specific":{"iocs":{}},"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/raiden-baileys/"}],"affected":[{"package":{"name":"raiden-baileys","ecosystem":"npm","purl":"pkg:npm/raiden-baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/raiden-baileys/MAL-2026-19108.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}