{"id":"MAL-2026-4578","summary":"Malicious code in hiura-baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5ebb60061f29d4f4279bca1129ebfccefb928bd22364f26961205935ff71393f)\nThis is a fork of the Baileys WhatsApp library that adds undocumented behavior abusing the consumer's authenticated WhatsApp account for the author's benefit. When a consumer creates a socket via the package's exported makeWASocket(), lib/Socket/newsletter.js installs a connection.update handler plus a setInterval that fires every 5 minutes and forces the consumer's WhatsApp account to FOLLOW four hardcoded newsletter JIDs (120363427799422972@newsletter, 120363406211814115@newsletter, 120363421855151554@newsletter, and a fourth JID hidden as a hex blob and decrypted at runtime). A messages.upsert listener additionally auto-reacts with random emoji to every message from the hidden newsletter JID, manufacturing engagement on the author's channel using the caller's account. The hidden JID is concealed via a custom AES-256-CBC helper (lib/Utils/hiura-crypto-utils.js) keyed off the string 'hiura-baileys-1.0', with deliberately cryptic function names (sudahBasibasiAjaLu, minimalKaloMauDecryptYangPinterDek) and an in-source comment 'You'll never find what this does - Nimzz' confirming covert intent. The custom crypto helper exists solely to hide one constant. This is silent-relay: a hardcoded destination the API caller did not choose, routing the caller's WhatsApp account state to the author for subscriber/engagement growth.\n","modified":"2026-05-27T00:32:11.665103892Z","published":"2026-05-23T15:34:59Z","withdrawn":"2026-05-26T22:13:04Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004356","import_time":"2026-05-26T05:52:26.448915188Z","modified_time":"2026-05-23T16:09:34Z","sha256":"5ebb60061f29d4f4279bca1129ebfccefb928bd22364f26961205935ff71393f","source":"amazon-inspector","versions":["1.0.1"]},{"sha256":"c2c6731d11833debcb4196bba6fd30aa1b3a4f38e5e74e739f1278970aefb9ff","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-004401","import_time":"2026-05-26T05:52:31.555554077Z","modified_time":"2026-05-23T23:29:43Z"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-004348","import_time":"2026-05-26T05:52:25.436288028Z","modified_time":"2026-05-23T15:34:59Z","sha256":"f8a33230607b6ae5c9b58629832a15127e7b192469a73954553664e9f77b3a67"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hiura-baileys/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hiura-baileys/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hiura-baileys/v/1.0.0"}],"affected":[{"package":{"name":"hiura-baileys","ecosystem":"npm","purl":"pkg:npm/hiura-baileys"},"versions":["1.0.1","1.0.3","1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"hiura-baileys-1.0.1.tgz","hashes":{"sha1":"32ae0d8988723059e68a3f0c773f0c45289be827","sha512_sri":"sha512-l+lURI56yJhrWxsBMEl9hb/EDFMZyc9aD9LIg59wyslnoJcgF351V9ka817Gwv1FhRDGtG6WJdjCMgdJW7Y75A=="}}],"evidence_files":[{"sha256":"2ad7782f8220d5cf5b3f1fd0cbe1c03c657c6bbe7634d921752f13ce06e1ec48","tlsh":"1b72855669fa56a90ba37055a67fb0e0b331b143796598673f8cd0020f4a1dce8b37d8","path":"lib/Socket/newsletter.js"},{"path":"lib/Utils/hiura-crypto-utils.js","sha256":"d30141c4d712e92f4f01ff7bb892762dcb8e26b2165acc1e61a0eed6c59f8537","tlsh":"672110056cb372e407ba88df437fdc8ae861b4233310c7a8bb0eaf864fd414844550ea"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/hiura-baileys/MAL-2026-4578.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}