@dreamguyxeon/baileyx
This report shows the evidence for @dreamguyxeon/baileyx@4.0.0. 5 of 7 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13930 confirms this npm version as malicious.
Advisory
MAL-2026-13930
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @dreamguyxeon/baileyx (npm)
Details
npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and silently FOLLOWs listed newsletter JIDs. Trigger is runtime (makeNewsletterSocket), not install. It also fetches Baileys version metadata from DGXeon13/dgxeon-soket and aliases libsignal to npm:@dgxeon13/libsignal-node@1.0.0 (a separate package that patches @whiskeysockets/baileys). Independently corroborated by LPM Firewall's public malicious report for 2.0.0. Related OSV entries: dgxeon-baileys (MAL-2026-2252), baileys-dgxeon (MAL-2025-806). Tarball sha256 for 5.0.0: 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db.
---
## Source: amazon-inspector (c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a) This package is a fork of the Baileys WhatsApp library that contains an undocumented runtime hijack of the consumer's authenticated WhatsApp account. In lib/Socket/newsletter.js (lines 102-122), when the consumer creates a WhatsApp socket — the package's main advertised function — a 120-second setTimeout fires, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and for each newsletter ID in that list issues a QueryIds.FOLLOW request under the user's authenticated session. The list is hosted on a mutable `main` branch under the package author's GitHub account, so the author can rotate the targeted channels at any time post-publication without republishing the package. The behavior is not mentioned in the README and is not gated by any user prompt or configuration. The main entrypoint lib/index.js is additionally wrapped in a custom base91 string-table decoder with anti-debugger `debugger` statements and `eval("this")`, concealing the bootstrap edges from casual review. The package also aliases the security-critical `libsignal` dependency to the same author's scope (`npm:@dreamguyxeon/libsignal-node@1.0.0`), placing crypto primitives under the same trust boundary as the silent-relay code. Installer harm: any consumer who connects this fork to their WhatsApp account has their identity used to silently follow channels of the author's choosing, with the target list mutable indefinitely.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The lifecycle script is benign, but core import-time code is deliberately opaque and cannot be source-verified as safe. Treat it as an unresolved staged payload carrier rather than confirmed malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Application imports lib/index.js.
Impact
Opaque import-time behavior prevents reliable verification of runtime effects.
Mechanism
Obfuscated runtime module loading with anti-debugging logic.
AI rationale
The lifecycle script is benign, but core import-time code is deliberately opaque and cannot be source-verified as safe. Treat it as an unresolved staged payload carrier rather than confirmed malware.
Evidence
package.jsonengine-requirements.jslib/index.jslib/Socket/messages-send.js
Independent scan evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- lib/index.js is a 3.5 MB obfuscated, anti-debugging import entrypoint.
- lib/index.js imports the obfuscated lib/Socket/messages-send.js at runtime.
- lib/Socket/messages-send.js is 943 KB of encoded/control-flow-obfuscated code.
- The preinstall hook only runs engine-requirements.js, which checks Node version.
Evidence against
- No concrete credential harvesting, file exfiltration, destructive action, or foreign AI-agent mutation was confirmed.
- No relevant non-package-aligned endpoint was found in inspected literal URLs.
Behavioral surface
ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
GitDependency
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/Socket/messages-send.jsView file
6L7: var __p_NlxI_array,__globalObject,__TextDecoder,__Uint8Array,__Buffer,__String,__Array,utf8ArrayToStr,__p_vqX9_imul,__importDefault,ListType;function __p_KtVi_cff_hash(int){var a=(...
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/Socket/messages-send.jsView on unpkg · L6lib/Types/Message.jsView file
3exports.WAMessageStatus = exports.WAMessageStubType = exports.WAProto = void 0;
L4: const WAProto_1 = require("../../WAProto");
L5: Object.defineProperty(exports, "WAProto", { enumerable: true, get: function () { return WAProto_1.proto; } });
Findings
3 High5 Medium7 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Similaritylib/Utils/messages.js
MediumDynamic Requirelib/Types/Message.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvallib/Socket/messages-send.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @dreamguyxeon/baileyx@4.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @dreamguyxeon/baileyx@4.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.