Malicious npm packages @gqb333/based and @gqb333/baileys — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-09
GitHub's Advisory Database published two malware advisories (GHSA-f562-w3mr-phwc, GHSA-h5vw-cqfg-mwhp) on 2026-11-09 for the npm packages @gqb333/based and @gqb333/baileys, both classified CWE-506 Embedded Malicious Code. Every version (= 0) is affected and no patched versions exist. The advisories state that any computer with the packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package does not guarantee removal of the malicious software. Anyone who installed either package is affected; the packages appear to be typosquat-style malicious publications under the @gqb333 scope (baileys mimicking the popular WhatsApp library name). No fix is available; remediation is host-level incident response and secret rotation.
What to do
- Treat any machine where @gqb333/based or @gqb333/baileys was installed or executed as fully compromised; rebuild from trusted images
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Remove the packages from dependencies and lockfiles; block the @gqb333 npm scope in registry proxies
- Audit affected hosts for persistence, unauthorized access and exfiltration; review CI/CD and developer workstations
- Check npm audit / dependency scans for these packages across all projects
Sources
All live incidents on Threat Watch
