A vulnerability in msgpack5 prior to version 6.1.0 allows a remote attacker to cause a denial of service by exhausting memory. The streaming decoder incorrectly treats the reserved MessagePack byte 0xc1 as incomplete input rather than invalid, causing it to buffer data indefinitely while waiting for bytes that will never form a valid value. This issue is fixed in version 6.1.0.
msgpack5 versions prior to 6.1.0 have an uncontrolled recursion vulnerability in their array and map decoding paths. This allows an attacker to submit deeply nested MessagePack input that exhausts the JavaScript call stack, causing process interruption. The issue is fixed in version 6.1.0.
### Impact
The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives. A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.
### Patches
The decoder now preserves incremental container state so completed elements are not parsed again when more input arrives.
### Workarounds
Buffer each complete MessagePack value before decoding it, or limit the number of chunks accepted for a single value.
CVE-2026-107296 is a low-severity vulnerability in the msgpack5 library for Node.js and browsers. Before version 6.1.0, decoding a negative signed 64-bit integer causes modification of the input buffer bytes used for decoding. This silent corruption affects applications that reuse or retain the encoded input for integrity checks, logging, or later processing. Positive integers and other MessagePack types are not affected. The issue is fixed in msgpack5 version 6.1.0.
The npm package 'clickfix_npm_delivery' contains malicious code designed as a social engineering lure. It delivers a fake Cloudflare Turnstile verification page that tricks victims into executing a PowerShell command, which downloads and runs a remote script, granting attackers arbitrary code execution on the victim's Windows machine. Installation of this package compromises the affected computer, potentially exposing all stored secrets and keys.
The npm package @galicia-toolkit/error-master version 999.0.3 contains malicious code that exfiltrates sensitive host and user information via DNS queries during installation. This occurs automatically on npm install without further user interaction. The package appears to be a dependency confusion attack payload designed to override an internal package. Systems with this package installed should be considered fully compromised.
The npm package @galicia-toolkit/tag-manager versions 999.0.3, 999.0.5, and 999.0.6 is a malicious dependency-confusion squat that executes code during installation to exfiltrate sensitive environment variables and host information to an external attacker-controlled server. It collects credential-grade environment variables such as AWS and GitHub tokens, enumerates system details, and sends this data via HTTP and DNS channels. The package contains no legitimate functionality and is designed solely for credential theft. Any system with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @galicia-toolkit/spa-build-config versions 999.0.3, 999.0.5, and 999.0.6 contains malicious code in its postinstall script. This script collects sensitive host and credential data, including environment variables with AWS, GitHub, npm, and GitHub Actions tokens, and exfiltrates this information to an external server. The package is likely a dependency confusion attack targeting internal scopes. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @bellaxchuu/familyxtrx version 0.1.5 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @bellaxchuu/flowblue version 1.5.7 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, enabling attackers to change targets post-installation. The malicious code abuses the installer's WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @bellaxchuu/privatebails version 1.4.1 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched to evade detection. This behavior abuses the victim's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/skyblue version 2.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel identifiers are obfuscated or dynamically fetched at runtime to evade detection. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/velvetry versions 0.1.3 and 0.1.4 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert subscription action into the WhatsApp socket layer, leveraging the installer's authenticated WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/xtrxbails (version 0.0.8) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, preventing easy detection. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The @xayz/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The target channels are obfuscated using various techniques and may be dynamically fetched from attacker-controlled sources. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The my-baileys npm package versions 1.0.1 through 1.0.5 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package @itsmee_aizat.id/baileys2 versions 2.0.0, 2.0.1, and 2.0.2 includes a runtime dependency on a GitHub repository (tenka-san/libsignal-node) controlled by an unrelated user. This dependency is fetched without integrity verification, allowing whoever controls that repository to execute arbitrary code on the installer's machine. The package loads this malicious code at runtime, leading to a full compromise of any computer where it is installed or running.
The npm package albert-anitabaileys version 1.1.13 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The cantarella-baileys npm package, versions 1.1.11 through 1.1.13, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channels are obfuscated or fetched dynamically to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @nyzzpediaa/baileys-new contains malicious code that silently subscribes the installer's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel IDs are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.