MAL-2026-16104

    Dashboard / Malicious Package / MAL-2026-16104

    MAL-2026-16104

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in @nexustechpro/baileys (npm)

    Details: Source: amazon-inspector (fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab) @nexustechpro/baileys is a fork of the WhatsApp library `baileys` in which lib/Socket/chats.js (~270 KB) is heavily obfuscated (obfuscator.io-style rotating string-array decoder, hex-escaped import specifiers such as '\x40\x63\x61\x63\x68\x65\x61\x62\x6c\x65\x2f\x6e\x6f\x64\x65\x2d\x63\x61\x63\x68\x65', integer-arithmetic control flow, unicode identifier names, ~2772-entry string array) while every sibling file in lib/Socket/ (groups.js, messages-recv.js, socket.js, registration.js) remains readable JavaScript and the upstream whiskeysockets/baileys ships this file unobfuscated. The obfuscated module is reachable from the package entry point (lib/index.js) and sits directly in the code path that handles WhatsApp session state (authState credentials, Signal identity keys, noise keys, signed pre-keys). package.json additionally declares `"whatsapp-rust-bridge": "latest"`, a floating unpinned tag on a non-upstream dependency, which allows that dependency's publisher to ship arbitrary code (including install lifecycle scripts) into every installer of this package on any future install with no version pin or integrity check.

    References: https://www.npmjs.com/package/@nexustechpro/baileys/v/2.2.7

    Affected packages

    Package

    Name: @nexustechpro/baileys

    Purl: pkg:npm/%40nexustechpro/baileys

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.2.7