{"schema_version":"1.9.2","id":"MAL-2026-17374","published":"2026-10-29T13:25:19Z","modified":"2026-10-29T13:48:10.699913509Z","summary":"Malicious code in @rennnpm/baileys (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @rennnpm/baileys (npm), version(s): 1.0.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1147bf0a20408ab406838da0e6aa5a2086deb1afe6651013a6081714ada641ff)\npackage.json declares the `libsignal` dependency as `github:tenka-san/libsignal-node`, a bare GitHub reference to a personal user's fork with no commit SHA, tag, or version constraint. On `npm install`, npm clones the default branch's current HEAD and runs any lifecycle scripts the fetched repository declares, executing that code on the installer's machine with no integrity check. Whoever controls the `tenka-san/libsignal-node` repository can change the code at any time, and every installer of this package will run whatever is at HEAD at that moment. The upstream `@whiskeysockets/baileys` package resolves `libsignal` from the npm registry at a pinned version; substituting a mutable third-party git reference in this fork replaces a registry-integrity-checked dependency with an unpinned attacker-controllable code source.\n","affected":[{"package":{"name":"@rennnpm/baileys","ecosystem":"npm","purl":"pkg:npm/%40rennnpm/baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"5b2fef196ea52195d883b080a956b3f7f66c030922fd0674dc327454a764606d","tlsh":"6c91dd33ce4cce630ab516e8a9bc4212f4791b1f6691d88fb27817ac8f72a475095f35"}],"package_integrity":[{"filename":"baileys-1.0.0.tgz","hashes":{"sha1":"4d3cd218974d75de022f230c036a6bf331bcf9f5","sha512_sri":"sha512-cDEs5t8kFyw5NM/UcaWT4TYrGoYePatVtr34luVNdDSZ491dU+NTn5P1VWtOuuN+wsTdxY/YrNNufvCsXT6CxQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rennnpm/baileys/MAL-2026-17374.json"}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@rennnpm/baileys/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021920","import_time":"2026-10-29T13:37:16.602960987Z","modified_time":"2026-10-29T13:25:19Z","sha256":"1147bf0a20408ab406838da0e6aa5a2086deb1afe6651013a6081714ada641ff","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}