Malicious npm package @smart-dev-wa/baileys — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published advisory GHSA-h4v8-6rq8-9pg3 on 2026-11-06 flagging the npm package @smart-dev-wa/baileys as malware (CWE-506, embedded malicious code). All published versions (= 0) are affected and there are no patched versions; the package appears to be a malicious fork/clone of the Baileys WhatsApp library. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Removal of the package alone does not guarantee removal of all malicious software. All secrets and keys on affected machines must be rotated from a clean computer.
What to do
- Immediately stop using and remove @smart-dev-wa/baileys from all projects and machines
- Rotate all secrets, API keys, tokens and credentials stored on affected machines, from a clean computer
- Rebuild/reimage affected machines; do not assume package removal removed the malware
- Audit dependency lockfiles and CI environments for the package and any persistence it may have installed
- Use the legitimate, vetted Baileys library (whiskeysockets/baileys) if WhatsApp automation is needed
Sources
All live incidents on Threat Watch
