@dyllxnn/baileys
A WebSockets library for interacting with WhatsApp Web.
This report shows the evidence for @dyllxnn/baileys@1.0.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 2h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18676 confirms this npm version as malicious.
Advisory
MAL-2026-18676
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @dyllxnn/baileys (npm)
Details
@dyllxnn/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363408893555851@newsletter, 120363412076734264@newsletter (stored base64-encoded), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The install hook only enforces a Node.js version requirement. The flagged GraphQL requests target WhatsApp hosts, and the fixed newsletter identifier is embedded in message metadata only when the caller invokes sendMessage for a chosen recipient.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Installation runs a Node.js version check; importing the entry point prints attribution; WhatsApp network operations occur through the client API.
Impact
No automatic credential theft, unrelated account action, or other attack behavior was found.
Mechanism
The install hook checks the runtime version, GraphQL requests use WhatsApp endpoints, and fixed newsletter metadata is used while building a message for the caller-provided destination.
AI rationale
The install hook only enforces a Node.js version requirement. The flagged GraphQL requests target WhatsApp hosts, and the fixed newsletter identifier is embedded in message metadata only when the caller invokes sendMessage for a chosen recipient.
Network endpoints3
graph.whatsapp.comacs.whatsapp.comwamo.whatsapp.net
Independent scan evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The preinstall script only checks the Node.js major version and exits on versions below 20.
- The package entry point exports the WhatsApp client and prints developer and package attribution at import time.
- GraphQL credentials are sent to the WhatsApp endpoint configured by the package.
- The fixed newsletter identifier appears in metadata for a message sent to the caller-provided JID.
- The special message handling is reached through the explicit sendMessage method.
Evidence against
- The package includes a custom media utility that invokes ffmpeg through child_process.exec.
- Importing the package prints promotional attribution, including the developer's channel.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
Affected versions and remediation
This report applies to @dyllxnn/baileys@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @dyllxnn/baileys@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.