{"id":"MAL-2026-4619","summary":"Malicious code in naileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53307e8df479525765ddef8cf9a54dcf0aa368b8ef57a088b624a5e80f72c999)\nnaileys is a fork/lookalike of the WhatsApp library baileys (single-character edit; internal references still mention 'wileys', and fetchLatestBaileysVersion in lib/Utils/generics.js queries https://registry.npmjs.org/wileys). On every successful WhatsApp connection, lib/Socket/newsletter.js (lines 83-99) executes a hardcoded auto-follow routine: a comment 'Naileys - Auto follow channels on connect' precedes a CHANNELS array containing three hardcoded JIDs ('120363426706961217@newsletter', '120363406068468165@newsletter', '120363420514587725@newsletter') and issues newsletterWMexQuery(jid, QueryIds.FOLLOW) for each. This fires automatically when a consumer simply uses the advertised makeWASocket API — no opt-in, no documentation, no configuration. The effect is that every WhatsApp account driven by naileys (the developer's account or any bot/end-user account using their software) is silently subscribed to author-controlled newsletter channels, modifying installer-side account state and giving the author guaranteed broadcast reach to every consumer. This is the silent-relay pattern: the package's documented API has an undisclosed side effect routed to a hardcoded author destination. The name-similarity to baileys plus verbatim API mimicry corroborates intentional typosquat-as-delivery-vehicle.\n","modified":"2026-05-27T00:32:07.178781823Z","published":"2026-05-20T12:27:33Z","withdrawn":"2026-05-26T22:13:04Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-05-26T05:50:47.804321042Z","modified_time":"2026-05-20T12:27:33Z","sha256":"53307e8df479525765ddef8cf9a54dcf0aa368b8ef57a088b624a5e80f72c999","source":"amazon-inspector","versions":["0.5.2"],"id":"IN-MAL-2026-003527"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/naileys/v/0.5.2"}],"affected":[{"package":{"name":"naileys","ecosystem":"npm","purl":"pkg:npm/naileys"},"versions":["0.5.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"lib/Socket/newsletter.js","sha256":"a51334b333e25bd42e3a9f2bf7c9153044cd6e28a74be30298ab45a04776161c","tlsh":"1842425a55ba5b6506b37454967ff0e1b321b303396698633f8c94020f0b1dda8f3bda"},{"tlsh":"72822bc99ff355760793a199ab2be0067b3a88133159c4f8ba1c83605f410a4cbda7e9","path":"lib/Utils/generics.js","sha256":"9d8b05fb9f7aae77284167b0a457521501fc7eea4cad3ddf6d77542a76be4111"}],"package_integrity":[{"filename":"naileys-0.5.2.tgz","hashes":{"sha1":"8c51beba4ef2cc088314eff9024ac407e22ff310","sha512_sri":"sha512-N9uShe2QT+97wbpJWi5tkuwoZ2KtE0gexAR3vVUoJ6r53/Nk2bt7zwzGdseRieqOtnAW6pmPXqjTUYDEu893ew=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/naileys/MAL-2026-4619.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}