MalwarePublished 6 Nov 2026

@smart-dev-wa/baileys (npm) · Malicious Code

Affects @smart-dev-wa/baileysSource GCVE Database

Malicious package : remove @smart-dev-wa/baileys and rotate any secrets on hosts that installed it.

Data as of 6 Nov 2026, 18:36 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17442

What to do

Remove @smart-dev-wa/baileys from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@smart-dev-wa/baileys	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @smart-dev-wa/baileys npm package version 1.0.0 contains malicious code that automatically subscribes the user's authenticated WhatsApp account to a specific WhatsApp Channel without user consent. This behavior contradicts the package's README claim of no auto-follow functionality. The malicious action occurs when an application using this library creates a WhatsApp socket connection. No credentials or session keys are exfiltrated, and no install-time payload or persistence mechanisms are present. The primary harm is unauthorized use of the victim's account to inflate subscriber counts for the attacker's chosen channels.

Impact

The impact is unauthorized use of the victim's authenticated WhatsApp account to subscribe to channels chosen by the attacker, potentially leading to privacy violations and unwanted content delivery. There is no evidence of credential theft or further compromise of the victim's system from this package alone. However, the presence of this malicious package indicates a compromise of trust and could lead to reputational damage or indirect harm through manipulation of WhatsApp channel subscriber counts.

Defensive guidance

Remove the @smart-dev-wa/baileys package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, trusted device, as the system should be considered fully compromised. Since the malicious code runs at runtime and no persistence was found, removal of the package stops the auto-subscription behavior. Monitor for any additional unauthorized software or activity on the affected system.

Summary

The @smart-dev-wa/baileys package, a fork of the Baileys WhatsApp Web library, includes injected code that, upon establishing a WhatsApp connection, sends a FOLLOW query to subscribe the user's WhatsApp account to a predefined newsletter channel (JID '120363408385315496@newsletter'). This occurs automatically without user interaction or opt-out. Static analysis of the package version 1.0.0 tarball shows no exfiltration of credentials or session keys and no install-time or persistent malicious payloads. The malicious behavior is limited to covertly subscribing the victim's account to the attacker's channels, thereby inflating subscriber numbers. The package's README falsely claims no auto-follow behavior. The SHA-256 hash of the malicious tarball is 7afa059f55b913a2b78dfcaf0a14adec87a494e166b9c1b4308df9f1eca580f0.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 18:36 UTC

Technical details

References

Community reviews