@ubedsockets/baileys: trojanized WhatsApp fork silently subscribes victims to attacker channels (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-04-15
GitHub's advisory GHSA-qwpw-cwrq-333j, backed by the OpenSSF OSV entry MAL-2026-18600, classifies the npm package @ubedsockets/baileys as malware. It is a trojanized fork of the WhatsApp library @whiskeysockets/baileys. According to OSV, on connection the injected code sends an authenticated WhatsApp w:mex newsletter FOLLOW request (queryid 7871414976211147) for two hardcoded channel JIDs, so the installer's own WhatsApp account is subscribed to attacker-chosen channels without consent; OSV states that the upstream library never hardcodes channel IDs or auto-follows on connect. All 26 published versions, from 1.0.0 (first published 2026-04-15) to 1.7.12 (2026-11-01), are listed as malicious, there is no fixed version, and the package was still listed on the npm registry when checked. The finder credited is wormsign, which found the subscription code by static analysis. The same queryid appears in three other OSV-listed Baileys forks (@hanzofc/baileys, @nyzzpediaa/baileys-new, @fyxzpediaa/baileys), which OSV describes as part of a family of 100+ near-identical forks; that is a technique-level link, not an attributed actor. Remove the package, check WhatsApp accounts that ran it for unwanted channel follows, re-authenticate sessions as a precaution (no source reports credential theft), and move to the official library.
What to do
- Remove @ubedsockets/baileys from all projects, lockfiles, node_modules and CI or deployment caches
- Search installed trees for engine-requirements.js with sha256 6062c07293ca867237aa5cec36b266771154914c0d686737c196adbb7de5d2f1 (wormsign detonation of 1.6.6)
- Audit WhatsApp accounts that ran the fork and unfollow the channels with JIDs 120363410154606795@newsletter and 120363423295236859@newsletter
- Re-authenticate WhatsApp sessions that ran the fork, as a precaution; no source reports credential theft
- Switch to the official @whiskeysockets/baileys and check dependency trees for other Baileys forks; OSV lists a family of 100+
- Check CI and deployment pipelines for cached installs of the malicious package
Sources
All live incidents on Threat Watch