Malicious code in @fyxzpediaa/baileys (npm)
Affects @fyxzpediaa/baileysSource GCVE Database
Rated by Threat Radar
Data as of 09/09/2026, 14:00:23 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@fyxzpediaa/baileys | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid using the @fyxzpediaa/baileys package version 8.1.2 and verify the integrity and source of Baileys library dependencies. Replace this malicious fork with the official Baileys package from trusted sources. Audit dependencies for mutable GitHub tarball references and avoid installing packages with such mutable dependencies. Monitor WhatsApp account activity for unauthorized actions and revoke session tokens if suspicious behavior is detected.
Description
The @fyxzpediaa/baileys npm package version 8.1.2 contains malicious code that covertly uses the installer's authenticated WhatsApp session to perform remote-directed actions. It fetches a JSON list from a mutable GitHub branch and issues authenticated queries to follow author-chosen newsletter IDs, obfuscated to evade source review. This behavior does not exfiltrate credentials, install persistence, or execute remote code on the host, but results in loss of control over the installer's WhatsApp account actions.
Impact
The malicious code abuses the installer's authenticated WhatsApp session to perform unauthorized follow actions on behalf of the user, leading to loss of control over their WhatsApp account interactions. There is no evidence of credential exfiltration, persistence mechanisms, or remote code execution on the host machine. The threat is confined to the WhatsApp account level, potentially enabling the attacker to manipulate the victim's WhatsApp contacts or subscriptions.