Malicious code in saturn-bail (npm)
The saturn-bail npm package, a derivative of the Baileys WhatsApp library, contains malicious code that silently subscribes users' WhatsApp accounts to a hardcoded newsletter channel controlled by the package author without consent or notification. It also includes functionality to spam pairing codes. This behavior inflates the author's subscriber count using third-party identities and compromises user trust. The package metadata is suspicious and mimics the legitimate Baileys library. Installation of this package may lead to full system compromise.
AI Analysis
Technical Summary
The saturn-bail npm package (version 1.1.12) is a malicious Baileys-derivative WhatsApp library that, upon each makeWASocket() call, schedules a timer to execute a function subscribing the authenticated WhatsApp session to a hardcoded newsletter channel controlled by the attacker. This action is performed silently with errors suppressed, without user consent or configuration options. Additionally, the package includes a helper that spams pairing codes. The package metadata is minimal and deceptive, mimicking the legitimate Baileys library. The malicious behavior effectively abuses user identities to benefit the attacker and may lead to full system compromise.
Potential Impact
Any developer or end-user whose WhatsApp account is paired through a bot built on this library is silently enrolled to follow the attacker's newsletter channel, inflating subscriber counts fraudulently. The package's pairing code spamming functionality can disrupt normal operations. The presence of this package on a system indicates a high risk of full compromise, potentially exposing all stored secrets and keys. Removal of the package alone may not eliminate all malicious software introduced.
Mitigation Recommendations
Immediate removal of the saturn-bail package (version 1.1.12) is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted device. Due to the potential for full system compromise, a thorough security assessment and remediation are advised. No official patch or fix is available. Users should avoid using this package and verify dependencies to prevent installation of malicious derivatives.
Malicious code in saturn-bail (npm)
Description
The saturn-bail npm package, a derivative of the Baileys WhatsApp library, contains malicious code that silently subscribes users' WhatsApp accounts to a hardcoded newsletter channel controlled by the package author without consent or notification. It also includes functionality to spam pairing codes. This behavior inflates the author's subscriber count using third-party identities and compromises user trust. The package metadata is suspicious and mimics the legitimate Baileys library. Installation of this package may lead to full system compromise.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The saturn-bail npm package (version 1.1.12) is a malicious Baileys-derivative WhatsApp library that, upon each makeWASocket() call, schedules a timer to execute a function subscribing the authenticated WhatsApp session to a hardcoded newsletter channel controlled by the attacker. This action is performed silently with errors suppressed, without user consent or configuration options. Additionally, the package includes a helper that spams pairing codes. The package metadata is minimal and deceptive, mimicking the legitimate Baileys library. The malicious behavior effectively abuses user identities to benefit the attacker and may lead to full system compromise.
Potential Impact
Any developer or end-user whose WhatsApp account is paired through a bot built on this library is silently enrolled to follow the attacker's newsletter channel, inflating subscriber counts fraudulently. The package's pairing code spamming functionality can disrupt normal operations. The presence of this package on a system indicates a high risk of full compromise, potentially exposing all stored secrets and keys. Removal of the package alone may not eliminate all malicious software introduced.
Defensive Guidance
Immediate removal of the saturn-bail package (version 1.1.12) is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted device. Due to the potential for full system compromise, a thorough security assessment and remediation are advised. No official patch or fix is available. Users should avoid using this package and verify dependencies to prevent installation of malicious derivatives.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4818
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-948w-97g3-hvpp"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8c7442acd9273b49d5e4d1
Added to database: 08/24/2026, 16:41:38 UTC
Last enriched: 08/24/2026, 16:52:42 UTC
Last updated: 08/24/2026, 17:01:41 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.