Malicious code in @viertechjs/baileys (npm)

The npm package @viertechjs/baileys in versions 7.0.0-rc14 and 6.7.22 has been identified as containing malicious code or relying on a dependency with malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code may allow attackers to gain full control over the affected system, risking exposure of sensitive credentials and secrets. Due to the nature of the compromise, simply removing the package may not fully remediate the infection.

Systems with the affected versions of @viertechjs/baileys installed are at risk of full compromise. Attackers may gain complete control over the host, leading to potential theft or misuse of secrets, keys, and other sensitive data. The compromise is severe enough that removal of the package alone is insufficient to ensure system security.

Immediate removal of the affected package versions is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, secure device. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected environment to ensure complete removal of malicious code. Monitor for any unusual activity and avoid reinstalling the affected package versions.