MAL-2026-15820

    Dashboard / Malicious Package / MAL-2026-15820

    MAL-2026-15820

    Published: 1 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in @systemzero/baileys (npm)

    Details: @systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller's authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested. Source: amazon-inspector (0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362) This fork of Baileys wires an undocumented remote-control channel into makeWASocket, the package's main factory. On every socket construction it unconditionally opens a Server-Sent-Events connection to the hardcoded author endpoint https://zone.api.br/api/owner/whatsapp-signal-stream and keeps it alive with automatic reconnect/backoff. Incoming events named 'react' and 'follow' are executed against the installer's authenticated WhatsApp session by calling sock.newsletterReactMessage and sock.newsletterFollow with server-supplied newsletter JIDs, letting a remote author-controlled server cause the installer's account to follow channels and post reactions chosen by the operator of that server. Neither the endpoint nor the remote-controlled behavior is disclosed in the README or opt-in. A sibling helper hzxx.js hardcodes a specific newsletter JID (120363362355300503@newsletter, name 'shenvn.') and author contact metadata (telegram @blackhzx), consistent with a reach-padding operation driving installer identities toward author-selected channels.

    References: https://www.npmjs.com/package/@systemzero/baileys, https://osv.dev/vulnerability/MAL-2026-13929, https://osv.dev/vulnerability/MAL-2026-13932, https://www.npmjs.com/package/@systemzero/baileys/v/1.1.2

    Affected packages

    Package

    Name: @systemzero/baileys

    Purl: pkg:npm/%40systemzero/baileys

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.2