MalwarePublished 21 Oct 2026Updated 29 Oct 2026

@alannxd/baileys (npm) · Malicious Code

Affects @alannxd/baileysSource GCVE Database

Malicious package : remove @alannxd/baileys and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18120

What to do

Remove @alannxd/baileys from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@alannxd/baileys	Affected 2.1.2 – 6.2.8 27 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @alannxd/baileys npm package is a malicious third-party fork of the legitimate @whiskeysockets/baileys WhatsApp library. Upon import, it performs an HTTPS GET request to a mutable URL controlled by the author, revealing the consumer's IP address. Although it does not execute remote code or exfiltrate credentials directly, the package poses a risk due to its namespace confusion potential and the import-time beacon to an author-controlled source. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and package removal.

Impact

The package reveals the IP address of any consumer importing it to the malicious package author. The mutable remote content URL allows the author to change the fetched data at any time, potentially enabling further malicious actions without new package releases. Security advisories state that any computer with this package installed should be treated as fully compromised, with all stored secrets and keys rotated immediately. The package name's similarity to a legitimate library increases the risk of accidental installation, potentially leading to unauthorized access or control.

Defensive guidance

Remove the @alannxd/baileys package immediately from all systems. Rotate all secrets and keys stored on affected computers from a separate, trusted device. Due to the potential full compromise of the system, further forensic analysis and remediation may be necessary. Avoid installing packages with names similar to well-known libraries without verifying their authenticity. Monitor for any suspicious activity related to this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:19 UTC

Technical details

References

Community reviews