Malicious code in @modss/baileys (npm)

@modss/baileys is a renamed fork of the Baileys WhatsApp Web library published in early September 2026. It contains malicious code in lib/Socket/newsletter.js that sets a URL pointing to a GitHub-hosted JSON list of newsletter IDs. Upon each connection update where the connection is 'open', the package fetches this list and automatically issues follow commands (executeWMexQuery FOLLOW) for each ID on the user's authenticated WhatsApp session. The followed IDs are cached locally. The list is controlled by the attacker and can be updated dynamically without redeploying the package. The package aliases its libsignal dependency under a new name but without malicious content. No credential or session key theft was detected, and the remote URL was not requested during analysis. The package is considered fully compromised, and any system running it should be treated as compromised.

The package grants an attacker the ability to control the WhatsApp session's follow actions by automatically following attacker-controlled channels. This can lead to unauthorized actions on the user's WhatsApp account. Although no credential or session key theft was observed, the presence of this malicious code means the system running the package is fully compromised. Secrets and keys stored on the affected system should be rotated immediately. Removing the package alone may not remove all malicious software resulting from its installation.

The package should be removed immediately from any affected system. All secrets and keys stored on the compromised system should be rotated from a different, trusted computer. Because the package grants full control over the system, assume full compromise and perform a thorough incident response. There is no official patch or fix available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.