MAL-2026-16070

Dashboard / Malicious Package / MAL-2026-16070

MAL-2026-16070

Summary: Malicious code in @fyxzpediaa/baileys (npm)

Details: Source: amazon-inspector (0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175) This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect() reconstructs a URL from a char-code array (decoding to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json), fetches a JSON list from that mutable GitHub branch, and 200 seconds after connect iterates the list issuing authenticated `w:mex` queries with query_id 7871414976211147 (QueryIds.FOLLOW) against the installer's own WhatsApp session. A separate exported helper `generateMessageV` decodes a base64+XOR(key=23)-obfuscated string to a hardcoded `<digits>@newsletter` JID and invokes the same FOLLOW query. The obfuscation of both the URL (char-code array) and the JID literal (base64+XOR) exists solely to hide these targets from source review; upstream Baileys does not contain this code path. The runtime dependency `@whiskeysockets/eslint-config` is also declared as a mutable GitHub tarball reference (`github:whiskeysockets/eslint-config`) rather than a pinned registry range, so `npm install` resolves it to whatever that repository's default branch currently contains. The covert action uses the installer's authenticated identity to gain reach for author-chosen newsletter IDs but does not exfiltrate credentials, install persistence, or execute remote code on the installer's host; the harm is loss of control over the installer's WhatsApp account actions, not machine compromise.

References: https://www.npmjs.com/package/@fyxzpediaa/baileys/v/8.1.2, https://www.npmjs.com/package/@fyxzpediaa/baileys/v/9.1.0