Malicious npm packages @vanzxy/baileys and @vanzxy/nusa fully compromise installed machines
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub Advisory Database published two malware advisories on 2026-11-03 for npm packages @vanzxy/baileys (GHSA-p29j-8jqp-jx9c, ~6,245 downloads/month, 2 GitHub stars) and @vanzxy/nusa (GHSA-32w9-v5cw-xh96, ~66 downloads/month). Both are classified CWE-506 Embedded Malicious Code, affect all versions (= 0), and have no patched versions. GitHub warns any computer with the packages installed or running should be considered fully compromised, with full control potentially given to an outside entity, and removal of the package does not guarantee removal of all malicious software. The @vanzxy/baileys name suggests a typosquat-style imitation of the popular Baileys WhatsApp library. All secrets and keys on affected machines are at risk; no fix exists other than removal and remediation.
What to do
- Immediately stop using and uninstall @vanzxy/baileys and @vanzxy/nusa from all systems and CI environments
- Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored or accessible on them, from a clean machine
- Rebuild/reimage affected hosts; package removal alone does not guarantee malware removal
- Audit dependency lockfiles and install history for these packages and any related @vanzxy packages
- Block the @vanzxy scope in npm registries and internal dependency firewalls
Sources
All live incidents on Threat Watch
