{"id":"MAL-2026-19152","summary":"Malicious code in @ndikagantengg/baileys (npm)","details":"Malicious package. `@ndikagantengg/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363428626908481@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","modified":"2026-11-12T05:45:05.984658265Z","published":"2026-11-03T14:15:37Z","database_specific":{"iocs":{}},"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/@ndikagantengg/baileys/"}],"affected":[{"package":{"name":"@ndikagantengg/baileys","ecosystem":"npm","purl":"pkg:npm/%40ndikagantengg%2Fbaileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ndikagantengg/baileys/MAL-2026-19152.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}