Malicious npm package @chatunitycenter/baileys — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub published advisory GHSA-g6j7-j669-23g6 on 2026-10-29 flagging the npm package @chatunitycenter/baileys as malware (CWE-506, embedded malicious code). Every published version (= 0) is affected and there are no patched versions, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. Anyone who installed this package — likely developers seeking the Baileys WhatsApp automation library — is affected. No fix exists; remediation requires removal, secret rotation from a clean machine, and system rebuild.
What to do
- Treat any machine with @chatunitycenter/baileys installed as fully compromised; isolate it
- Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and rebuild/reimage affected systems rather than trusting cleanup
- Audit npm lockfiles and CI environments for the package and block it in dependency firewalls
- Review access logs and monitor for follow-on attacker activity
Sources
All live incidents on Threat Watch
