Skip to main content
MalwarePublished

raiden-baileys (npm) · Malicious Code

Affects raiden-baileysSource GCVE Database

0

Malicious package : remove raiden-baileys and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 05:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-19108

What to do

Remove raiden-baileys from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmraiden-baileyspkg:npm/raiden-baileysOther threatsAffected
  • 0.0.0-stage – 2.2.5
15 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The raiden-baileys npm package is a trojanized fork of the Baileys WhatsApp library that silently subscribes victims to attacker-controlled WhatsApp channels upon connection. It includes a dependency-confusion attack by referencing a personal GitHub repository for the libsignal dependency, allowing arbitrary code execution during installation. All published versions of raiden-baileys are malicious.

References

Community reviews

Loading reviews…