Malicious npm package zero2-baileys — full host compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
GitHub published a malware advisory (GHSA-79c7-wq2p-hx6p) for the npm package zero2-baileys, flagged as embedded malicious code (CWE-506). All versions (= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying the package grants attackers full control of the host, enabling theft of secrets, keys and credentials and persistence beyond simple removal. Anyone who installed zero2-baileys — likely developers seeking WhatsApp/Baileys-style automation libraries — is affected. There is no fix; remediation is removal of the package plus full incident response, since uninstalling cannot guarantee removal of all malicious software.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines immediately, using a clean computer
- Isolate and rebuild affected machines; do not rely on uninstalling the package to remove the malware
- Audit systems and CI/CD environments for installation of zero2-baileys and any persistence mechanisms or unauthorized access
- Review access and network logs for signs of exfiltration or attacker activity
- Block/flag zero2-baileys in dependency management and internal registries
Sources
All live incidents on Threat Watch
