MAL-2026-16199

    Dashboard / Malicious Package / MAL-2026-16199

    MAL-2026-16199

    Published: 8 Sept 2026Last Modified: 30 Sept 2026

    Summary: Malicious code in plogme (npm)

    Details: plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys (MAL-2026-15917), and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js (javascript-obfuscator output, identical to the file in MAL-2026-15917) hardcodes the publisher's WhatsApp newsletter channels 120363423670814885@newsletter and 120363402922206865@newsletter and exports followCrysnovaxTrustedChannels(); lib/Socket/socket.js invokes it from the connection.update handler, so the user's own authenticated WhatsApp account silently follows both channels on every successful connection, with no opt-out. lib/Utils/integrity.js hashes hostname, platform, arch, cpu model and Node version into a machine fingerprint and POSTs it with the package identity to https://bailey.crysnovax.link/api/v1/verify on every socket connect. The obfuscated follow module was decoded, not executed. Source: amazon-inspector (119fcc6129acfa344451ddc3153a9f5215ec2a2c9650a8cb891efc29e774f5f1) The package was found to contain malicious code or consuming dependency that contains malicious code

    References: https://osv.dev/vulnerability/MAL-2026-15917, https://pkgwarden.com/incidents/baileys-whatsapp-auto-follow-npm-september-2026/, https://www.npmjs.com/package/plogme/v/1.0.2, https://www.npmjs.com/package/plogme/v/1.0.3, https://www.npmjs.com/package/plogme/v/1.0.1, https://www.npmjs.com/package/plogme/v/1.0.0

    Affected packages

    Package

    Name: plogme

    Purl: pkg:npm/plogme

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    1.0.2
    1.0.3