Malicious code in @dreamguyxeon/baileyx (npm)
npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and silently FOLLOWs listed newsletter JIDs. Trigger is runtime (makeNewsletterSocket), not install. It also fetches Baileys version metadata from DGXeon13/dgxeon-soket and aliases libsignal to npm:@dgxeon13/[email protected] (a separate package that patches @whiskeysockets/baileys). Independently corroborated by LPM Firewall's public malicious report for 2.0.0. Related OSV entries: dgxeon-baileys (MAL-2026-2252), baileys-dgxeon (MAL-2025-806). Tarball sha256 for 5.0.0: 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a) This package is a fork of the Baileys WhatsApp library that contains an undocumented runtime hijack of the consumer's authenticated WhatsApp account. In lib/Socket/newsletter.js (lines 102-122), when the consumer creates a WhatsApp socket — the package's main advertised function — a 120-second setTimeout fires, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and for each newsletter ID in that list issues a QueryIds.FOLLOW request under the user's authenticated session. The list is hosted on a mutable `main` branch under the package author's GitHub account, so the author can rotate the targeted channels at any time post-publication without republishing the package. The behavior is not mentioned in the README and is not gated by any user prompt or configuration. The main entrypoint lib/index.js is additionally wrapped in a custom base91 string-table decoder with anti-debugger `debugger` statements and `eval("this")`, concealing the bootstrap edges from casual review. The package also aliases the security-critical `libsignal` dependency to the same author's scope (`npm:@dreamguyxeon/[email protected]`), placing crypto primitives under the same trust boundary as the silent-relay code. Installer harm: any consumer who connects this fork to their WhatsApp account has their identity used to silently follow channels of the author's choosing, with the target list mutable indefinitely.
AI Analysis
Technical Summary
The @dreamguyxeon/baileyx npm package is a Baileys WhatsApp Web API fork containing undocumented runtime code that hijacks the user's authenticated WhatsApp session. Specifically, in lib/Socket/newsletter.js, after socket setup, a 120-second timer triggers a fetch of a JSON list of newsletter JIDs from a GitHub repository controlled by the attacker. The package then silently issues follow requests for these newsletters under the user's identity. The list is hosted on a mutable branch, allowing the attacker to change targets dynamically without republishing the package. The main entrypoint is obfuscated with anti-debugging techniques, and the package aliases the libsignal cryptographic dependency to a malicious version under the attacker's scope, consolidating trust boundaries. This results in unauthorized actions performed on behalf of the user without consent or disclosure.
Potential Impact
Users who install and run this package with their WhatsApp account have their identity used to silently follow attacker-controlled newsletters, potentially exposing them to unwanted content or tracking. The attacker can dynamically change the list of followed newsletters at any time post-installation by modifying the remote JSON file. The cryptographic primitives are also compromised by the malicious aliasing of libsignal, which may further undermine security. There is no indication of direct data theft or account takeover, but the unauthorized actions violate user trust and may facilitate further malicious activities.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing or using @dreamguyxeon/baileyx and related packages. Verify the authenticity of Baileys WhatsApp API packages by using official sources and trusted maintainers. Remove any existing installations of this package from environments where it has been used. Monitor for suspicious follow activity on WhatsApp accounts connected to this package. Since the malicious behavior is runtime-triggered, uninstalling the package and revoking any tokens or sessions associated with it is recommended.
Malicious code in @dreamguyxeon/baileyx (npm)
Description
npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and silently FOLLOWs listed newsletter JIDs. Trigger is runtime (makeNewsletterSocket), not install. It also fetches Baileys version metadata from DGXeon13/dgxeon-soket and aliases libsignal to npm:@dgxeon13/[email protected] (a separate package that patches @whiskeysockets/baileys). Independently corroborated by LPM Firewall's public malicious report for 2.0.0. Related OSV entries: dgxeon-baileys (MAL-2026-2252), baileys-dgxeon (MAL-2025-806). Tarball sha256 for 5.0.0: 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a) This package is a fork of the Baileys WhatsApp library that contains an undocumented runtime hijack of the consumer's authenticated WhatsApp account. In lib/Socket/newsletter.js (lines 102-122), when the consumer creates a WhatsApp socket — the package's main advertised function — a 120-second setTimeout fires, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and for each newsletter ID in that list issues a QueryIds.FOLLOW request under the user's authenticated session. The list is hosted on a mutable `main` branch under the package author's GitHub account, so the author can rotate the targeted channels at any time post-publication without republishing the package. The behavior is not mentioned in the README and is not gated by any user prompt or configuration. The main entrypoint lib/index.js is additionally wrapped in a custom base91 string-table decoder with anti-debugger `debugger` statements and `eval("this")`, concealing the bootstrap edges from casual review. The package also aliases the security-critical `libsignal` dependency to the same author's scope (`npm:@dreamguyxeon/[email protected]`), placing crypto primitives under the same trust boundary as the silent-relay code. Installer harm: any consumer who connects this fork to their WhatsApp account has their identity used to silently follow channels of the author's choosing, with the target list mutable indefinitely.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @dreamguyxeon/baileyx npm package is a Baileys WhatsApp Web API fork containing undocumented runtime code that hijacks the user's authenticated WhatsApp session. Specifically, in lib/Socket/newsletter.js, after socket setup, a 120-second timer triggers a fetch of a JSON list of newsletter JIDs from a GitHub repository controlled by the attacker. The package then silently issues follow requests for these newsletters under the user's identity. The list is hosted on a mutable branch, allowing the attacker to change targets dynamically without republishing the package. The main entrypoint is obfuscated with anti-debugging techniques, and the package aliases the libsignal cryptographic dependency to a malicious version under the attacker's scope, consolidating trust boundaries. This results in unauthorized actions performed on behalf of the user without consent or disclosure.
Potential Impact
Users who install and run this package with their WhatsApp account have their identity used to silently follow attacker-controlled newsletters, potentially exposing them to unwanted content or tracking. The attacker can dynamically change the list of followed newsletters at any time post-installation by modifying the remote JSON file. The cryptographic primitives are also compromised by the malicious aliasing of libsignal, which may further undermine security. There is no indication of direct data theft or account takeover, but the unauthorized actions violate user trust and may facilitate further malicious activities.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users and organizations should avoid installing or using @dreamguyxeon/baileyx and related packages. Verify the authenticity of Baileys WhatsApp API packages by using official sources and trusted maintainers. Remove any existing installations of this package from environments where it has been used. Monitor for suspicious follow activity on WhatsApp accounts connected to this package. Since the malicious behavior is runtime-triggered, uninstalling the package and revoking any tokens or sessions associated with it is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13930
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7e036abf8831d5398f8acc
Added to database: 08/13/2026, 17:48:26 UTC
Last enriched: 08/13/2026, 18:06:58 UTC
Last updated: 09/25/2026, 10:56:12 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.