Malware in luna-baileys npm package — full host compromise, rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub published a malware advisory (GHSA-45rq-6v9r-4475) on 2026-11-03 for the npm package luna-baileys, flagged as containing embedded malicious code (CWE-506). Affected versions include 0.0.0-stage, 1.0.0, and 9.0.24–9.0.28 and 9.0.33, with no patched versions available. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host, enabling theft of secrets, keys, and credentials. Any project depending on luna-baileys — an apparent WhatsApp/Baileys-style library — is affected. There is no fix; removal of the package does not guarantee removal of all malicious software, so incident response beyond uninstalling is required.
What to do
- Rotate all secrets, keys, and credentials stored on machines where luna-baileys was installed, using a clean computer
- Remove luna-baileys from all projects and lockfiles and audit for transitive dependencies on it
- Rebuild/reimage affected machines; do not assume uninstalling removed the malware
- Review access logs and monitor for suspicious activity from affected hosts
- Block/flag luna-baileys in internal registries and CI to prevent reintroduction
Sources
All live incidents on Threat Watch
