Malicious npm packages diezyx*-baileys / diezy-libsignal-node — full host compromise via embedded malware (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
On 2026-11-12 GitHub published four malware advisories for npm packages diezyxhao-baileys, diezyxalya-baileys, diezyxalisa-baileys and diezy-libsignal-node, all flagged CWE-506 (embedded malicious code) with severity critical. Every version (= 0) is affected and no patched versions exist. The packages, whose names mimic the popular Baileys WhatsApp library ecosystem, collectively see roughly 3,500 downloads per month. GitHub warns that any machine with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. No CVE is assigned; remediation is limited to removal and incident response, as no fix will be published.
What to do
- Immediately uninstall all four packages from every machine and CI environment and rebuild from clean images
- Rotate all secrets, keys, tokens and credentials that were stored on or accessible from affected machines, from a clean computer
- Audit install logs and dependency lockfiles to identify when and where the packages were introduced
- Inspect affected hosts for persistence mechanisms and residual malware; reimage if compromise is suspected
- Block these package names in npm registries/proxies and add them to dependency scanning denylists
Sources
All live incidents on Threat Watch
