MAL-2026-18600

    Dashboard / Malicious Package / MAL-2026-18600

    MAL-2026-18600

    Published: 2 Nov 2026Last Modified: 4 Nov 2026

    Summary: Malicious code in @ubedsockets/baileys (npm)

    Details: Malicious package. `@ubedsockets/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363410154606795@newsletter, 120363423295236859@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.

    References: https://wormsign.io/portfolio/@ubedsockets/baileys/

    Affected packages

    Package

    Name: @ubedsockets/baileys

    Purl: pkg:npm/%40ubedsockets%2Fbaileys

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.0