Malicious npm packages @realvare/based and @realvare/baileys — full host compromise; remove and rotate secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub's Advisory Database published malware advisories on 2026-11-04 for two npm packages under the @realvare scope: @realvare/based (GHSA-r5hx-v68j-8w57, ~2,348 downloads/month, 10 GitHub stars) and @realvare/baileys (GHSA-3959-8jgw-g6xp, ~529 downloads/month). Both are flagged CWE-506 Embedded Malicious Code, affect every version (= 0), and have no patched versions. GitHub's guidance states any computer with the packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and removal of the package may not remove all malicious software. The baileys name suggests a typosquat-style impersonation of the popular WhatsApp library Baileys. No CVEs are assigned; no fixed versions exist.
What to do
- Remove @realvare/based and @realvare/baileys from all projects and lockfiles immediately
- Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer
- Rebuild/reimage compromised machines; do not assume package removal removed the malware
- Audit install and CI logs for any use of these packages and check for persistence or exfiltration
- Block the @realvare scope in npm policy and prefer the legitimate upstream packages
Sources
All live incidents on Threat Watch
