@zanxiky/baileys (npm): trojanized Baileys fork silently subscribes victims to attacker WhatsApp channels
Severity: critical · Patch status: no-fix-needed · Since 2026-11-10
GitHub Advisory Database (GHSA-43rp-v8rh-9333, credited to OpenSSF's malicious-packages database) flags the npm package @zanxiky/baileys as malware. It is a trojanized fork of the legitimate Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated w:mex newsletter FOLLOW mutation (queryid 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels with hardcoded JIDs 120363399602691477@newsletter and 120363421563597486@newsletter. Legitimate Baileys never hardcodes channel JIDs or auto-follows on connect. All published versions (0, =0.0.0-stage, =1.1.0) are malicious and there are no fixed versions. Detected via wormsign static analysis. Anyone who installed the package is affected; the fix is removal and use of the legitimate library.
What to do
- Remove @zanxiky/baileys from all projects and lockfiles immediately; do not use any version
- Audit WhatsApp sessions/connections created while the package was installed and unlink unfamiliar sessions
- Replace with the legitimate @whiskeysockets/baileys from a verified source
- Check whether any attacker-controlled channels were followed on connected accounts and unfollow them
- Review CI/CD and dependency resolution to ensure the package cannot be reintroduced
Sources
All live incidents on Threat Watch
