MalwarePublished 10 Aug 2026Updated 21 Oct 2026

@dreamguyxeon/baileyx (npm) · Malicious Code

Affects @dreamguyxeon/baileyxSource GCVE Database

Malicious package : remove @dreamguyxeon/baileyx and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13930

What to do

Remove @dreamguyxeon/baileyx from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@dreamguyxeon/baileyx	Affected 1.0.0 – 5.0.0 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and silently FOLLOWs listed newsletter JIDs. Trigger is runtime (makeNewsletterSocket), not install. It also fetches Baileys version metadata from DGXeon13/dgxeon-soket and aliases libsignal to npm:@dgxeon13/libsignal-node@1.0.0 (a separate package that patches @whiskeysockets/baileys). Independently corroborated by LPM Firewall's public malicious report for 2.0.0. Related OSV entries: dgxeon-baileys (MAL-2026-2252), baileys-dgxeon (MAL-2025-806). Tarball sha256 for 5.0.0: 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a) This package is a fork of the Baileys WhatsApp library that contains an undocumented runtime hijack of the consumer's authenticated WhatsApp account. In lib/Socket/newsletter.js (lines 102-122), when the consumer creates a WhatsApp socket — the package's main advertised function — a 120-second setTimeout fires, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and for each newsletter ID in that list issues a QueryIds.FOLLOW request under the user's authenticated session. The list is hosted on a mutable `main` branch under the package author's GitHub account, so the author can rotate the targeted channels at any time post-publication without republishing the package. The behavior is not mentioned in the README and is not gated by any user prompt or configuration. The main entrypoint lib/index.js is additionally wrapped in a custom base91 string-table decoder with anti-debugger `debugger` statements and `eval("this")`, concealing the bootstrap edges from casual review. The package also aliases the security-critical `libsignal` dependency to the same author's scope (`npm:@dreamguyxeon/libsignal-node@1.0.0`), placing crypto primitives under the same trust boundary as the silent-relay code. Installer harm: any consumer who connects this fork to their WhatsApp account has their identity used to silently follow channels of the author's choosing, with the target list mutable indefinitely.

Impact

Users who install and run this package with their WhatsApp account have their identity used to silently follow attacker-controlled newsletters, potentially exposing them to unwanted content or tracking. The attacker can dynamically change the list of followed newsletters at any time post-installation by modifying the remote JSON file. The cryptographic primitives are also compromised by the malicious aliasing of libsignal, which may further undermine security. There is no indication of direct data theft or account takeover, but the unauthorized actions violate user trust and may facilitate further malicious activities.

Defensive guidance

Users and organizations should avoid installing or using @dreamguyxeon/baileyx and related packages. Verify the authenticity of Baileys WhatsApp API packages by using official sources and trusted maintainers. Remove any existing installations of this package from environments where it has been used. Monitor for suspicious follow activity on WhatsApp accounts connected to this package. Since the malicious behavior is runtime-triggered, uninstalling the package and revoking any tokens or sessions associated with it is recommended.

Summary

The @dreamguyxeon/baileyx npm package is a Baileys WhatsApp Web API fork containing undocumented runtime code that hijacks the user's authenticated WhatsApp session. Specifically, in lib/Socket/newsletter.js, after socket setup, a 120-second timer triggers a fetch of a JSON list of newsletter JIDs from a GitHub repository controlled by the attacker. The package then silently issues follow requests for these newsletters under the user's identity. The list is hosted on a mutable branch, allowing the attacker to change targets dynamically without republishing the package. The main entrypoint is obfuscated with anti-debugging techniques, and the package aliases the libsignal cryptographic dependency to a malicious version under the attacker's scope, consolidating trust boundaries. This results in unauthorized actions performed on behalf of the user without consent or disclosure.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Aug 2026, 18:06 UTC

Technical details

References

Community reviews