The @dreamguyxeon/baileyx npm package is a Baileys WhatsApp Web API fork containing undocumented runtime code that hijacks the user's authenticated WhatsApp session. Specifically, in lib/Socket/newsletter.js, after socket setup, a 120-second timer triggers a fetch of a JSON list of newsletter JIDs from a GitHub repository controlled by the attacker. The package then silently issues follow requests for these newsletters under the user's identity. The list is hosted on a mutable branch, allowing the attacker to change targets dynamically without republishing the package. The main entrypoint is obfuscated with anti-debugging techniques, and the package aliases the libsignal cryptographic dependency to a malicious version under the attacker's scope, consolidating trust boundaries. This results in unauthorized actions performed on behalf of the user without consent or disclosure.

Users who install and run this package with their WhatsApp account have their identity used to silently follow attacker-controlled newsletters, potentially exposing them to unwanted content or tracking. The attacker can dynamically change the list of followed newsletters at any time post-installation by modifying the remote JSON file. The cryptographic primitives are also compromised by the malicious aliasing of libsignal, which may further undermine security. There is no indication of direct data theft or account takeover, but the unauthorized actions violate user trust and may facilitate further malicious activities.

No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing or using @dreamguyxeon/baileyx and related packages. Verify the authenticity of Baileys WhatsApp API packages by using official sources and trusted maintainers. Remove any existing installations of this package from environments where it has been used. Monitor for suspicious follow activity on WhatsApp accounts connected to this package. Since the malicious behavior is runtime-triggered, uninstalling the package and revoking any tokens or sessions associated with it is recommended.