@pasqua-baileys/baileys npm package is malware — full machine compromise; rotate all secrets
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
GitHub published a malware advisory (GHSA-73vv-6qcp-qgpw) for the npm package @pasqua-baileys/baileys, an apparently malicious variant of the Baileys WhatsApp library. All versions (= 0) are affected and there are no patched versions; the package embeds malicious code (CWE-506) that gives an outside entity full control of any machine where it is installed or running. Roughly 1,939 downloads per month indicate a limited but real install base. Any computer with the package should be treated as fully compromised, with secrets and keys exposed to the attacker. Removal of the package does not guarantee removal of all malicious software it may have installed. No fix exists; remediation is removal plus incident response.
What to do
- Treat any machine with @pasqua-baileys/baileys installed as fully compromised; isolate it immediately
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Remove the package and rebuild/reimage affected systems; audit for persistence and additional malware
- Audit dependency trees and lockfiles for the package and block it in registries/CI
- Review logs and network traffic for signs of exfiltration or attacker access
Sources
All live incidents on Threat Watch
