MAL-2026-4478

    Dashboard / Malicious Package / MAL-2026-4478

    MAL-2026-4478

    Published: 19 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in alya-baileys (npm)

    Details: Source: amazon-inspector (473103f2220a0215abf49be7e46ec1748052935ce188e0eee6ded08af7b47cf1) alya-baileys is a fork of the Baileys WhatsApp library that adds a hidden, remotely-controlled action channel against the installer's authenticated WhatsApp session. In lib/Socket/newsletter.js, on every `connection.update` where the connection opens, the package decrypts an AES-256-CBC-encrypted URL (built from hex-chunk passphrase material in lib/Utils/alya.js that decodes to 'Alyabaileys' and a 'raw.githubcontent.com' host) via `alyaDecryptCore` and fetches author-controlled configuration with axios. That config drives three classes of action on the user's WhatsApp account: auto-following newsletters, auto-reacting (random or keyword-mapped emojis) to every message in any newsletter marked 'enabled' in the remote config, and auto-voting in polls with a configurable strategy ('random'/'first'/'last'). Only auto-follow is mentioned in the README; the auto-react and auto-vote behaviors are undisclosed. The remote endpoint can change targets and behavior at any time post-install, giving the author a persistent runtime channel to direct the installer's authenticated WhatsApp identity. Intent is reinforced by deliberate obfuscation: AES-encrypted URLs and JIDs decrypted at runtime, hex-chunk-built passphrases, five no-op aliased requires of `./Utils/alya` (`hapus_aja`, `gak_penting_asli`, `_apacoba_wkwk`,...) that exist only to confuse review, and a literal comment in newsletter.js line 200: `// You'll never find what this does - Ibra Decode`. The package name impersonates the well-known `baileys` / `@whiskeysockets/baileys` library and re-exports the same public API (`makeWASocket`, `useMultiFileAuthState`), increasing the chance an installer adopts it unintentionally.

    References: https://www.npmjs.com/package/alya-baileys/v/1.9.36, https://www.npmjs.com/package/alya-baileys/v/1.9.45, https://www.npmjs.com/package/alya-baileys/v/1.9.35, https://www.npmjs.com/package/alya-baileys/v/1.9.42, https://www.npmjs.com/package/alya-baileys/v/1.9.39, https://www.npmjs.com/package/alya-baileys/v/1.9.46, https://www.npmjs.com/package/alya-baileys/v/1.9.38, https://www.npmjs.com/package/alya-baileys/v/1.9.37

    Affected packages

    Package

    Name: alya-baileys

    Purl: pkg:npm/alya-baileys

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.9.36
    1.9.45
    1.9.35
    1.9.42
    1.9.39
    1.9.46
    1.9.38
    1.9.37
    MAL-2026-4478 | CVE-DB