@erlanzz/baileys npm package — malicious code compromises any machine where it is installed
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub's malware advisory database published GHSA-f8j3-x796-h5cm on 2026-11-10 flagging the npm package @erlanzz/baileys as containing embedded malicious code (CWE-506). All published versions (= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed the package — likely developers seeking a WhatsApp/Baileys-style library — is affected. Removal of the package alone is not guaranteed to remove the malicious software. No CVE; treated as malware in the npm supply chain.
What to do
- Immediately rotate all secrets, keys, tokens and credentials stored on any machine where @erlanzz/baileys was installed, using a clean machine
- Isolate and rebuild any machine or CI environment where the package was installed; do not trust removal of the package alone
- Audit npm lockfiles and dependency trees for @erlanzz/baileys and block/remove it from all projects and caches
- Review access logs and network traffic from affected hosts for signs of attacker control or exfiltration
- Revoke and reissue npm, git and cloud credentials that may have been accessible from compromised hosts
Sources
All live incidents on Threat Watch
