ourin-baileys npm package — malicious WhatsApp library flagged as embedded malware (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-30
GitHub's advisory database published a malware advisory (GHSA-5qgv-v3j9-f64g) for the npm package ourin-baileys, an apparent typosquat/clone of the Baileys WhatsApp library. The package is classified as embedded malicious code (CWE-506) affecting all versions, with no patched version and no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying full remote control by an outside entity and exposure of all secrets and keys on the machine. With roughly 12K downloads per month, developers and CI environments depending on it are at risk. Removal of the package alone is not guaranteed to remove all malicious software. There is no fix; remediation is incident response, not upgrading.
What to do
- Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean computer
- Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system
- Audit dependency trees and lockfiles for ourin-baileys and block it in registries/proxies
- Review access logs and network traffic for signs of compromise
- Notify incident response if production systems or customer data were exposed
Sources
All live incidents on Threat Watch
