Malicious npm package @systemzero/baileys — full compromise of installed machines; rotate all secrets (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's Advisory Database published GHSA-7fxw-7r63-529q on 2026-11-03 flagging the npm package @systemzero/baileys as malware (CWE-506, Embedded Malicious Code). All versions (= 0) are affected and no patched version exists; the package has no known source code repository and averages ~2,629 downloads per month. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and removal of the package does not guarantee removal of all malicious software. Any developer or CI environment that installed it should treat stored secrets and keys as stolen. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine
- Remove @systemzero/baileys from all projects and lockfiles and rebuild affected machines from trusted images
- Audit systems for persistence and other malicious software left behind after removal
- Check npm audit logs/CI for installs of the package and block it in dependency policies
Sources
All live incidents on Threat Watch
