Malicious code in @systemzero/baileys (npm)

The @systemzero/baileys npm package is a fork of the legitimate @whiskeysockets/baileys WhatsApp Web library. It introduces a hidden remote-control channel by hardcoding a SIGNAL_STREAM_URL endpoint (https://zone.api.br/api/owner/whatsapp-signal-stream) that is connected to unconditionally on every socket creation. This connection uses Server-Sent Events to receive commands named 'react' and 'follow', which execute actions on the authenticated WhatsApp session such as following attacker-specified channels and reacting to messages with attacker-chosen emojis. These actions occur without any developer opt-in or configuration and are not part of the original upstream library. The malicious behavior was confirmed by static code reviews and is linked to a known WhatsApp newsletter auto-follow campaign. The affected version is 1.1.2.

An attacker controlling the remote server can force the victim's WhatsApp account to follow specific channels and post reactions without the user's knowledge or consent. This can lead to unwanted propagation of attacker-chosen content, potential reputation damage, and loss of user control over their WhatsApp account. The malicious code runs automatically on every socket connection created by the library, making all users of this package vulnerable to remote manipulation.

No official patch or remediation is currently documented. Users should avoid using the @systemzero/baileys package, especially version 1.1.2. Since the malicious behavior is hardcoded and unconditional, replacing this package with the official upstream @whiskeysockets/baileys library or another trusted alternative is recommended. Monitor for updates from the package maintainers or security advisories for any future fixes. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for current remediation guidance.