Malicious npm package grizzly-baileys — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub published a malware advisory (GHSA-7vq2-mvjp-g5gf) for the npm package grizzly-baileys, flagged as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host. Anyone who installed the package — likely developers seeking a WhatsApp/Baileys-style library — is affected. The package sees roughly 326 downloads per month. Removal of the package alone is not guaranteed to remove all malicious software. There is no fix; remediation is incident response: isolate, rebuild, and rotate credentials.
What to do
- Treat any machine with grizzly-baileys installed as fully compromised; disconnect and rebuild from clean images
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Audit for persistence and additional malicious software left behind; do not rely on uninstalling the package
- Check dependency lockfiles and CI systems for the package and block it in registries/proxies
- Review logs for signs of exfiltration or attacker activity since installation
Sources
All live incidents on Threat Watch
