OpenSSF/OSV advisory MAL-2026-4803 confirms this npm version as malicious. This package is a Baileys (WhatsApp Web library) fork that, on every WebSocket connection, silently performs WhatsApp newsletter actions on the consumer's authenticated WhatsApp account driven by a remote, mutable, author-controlled list. In lib/Socket/socket.js, validateConnection() awaits an undocumented socketConnect() helper whose target URL is obfuscated as a String.fromCharCode array decoding to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @fhkry/baileys (npm)
Details
This package is a Baileys (WhatsApp Web library) fork that, on every WebSocket connection, silently performs WhatsApp newsletter actions on the consumer's authenticated WhatsApp account driven by a remote, mutable, author-controlled list. In lib/Socket/socket.js, validateConnection() awaits an undocumented socketConnect() helper whose target URL is obfuscated as a String.fromCharCode array decoding to https://raw.githubusercontent.com/Fhkryyy/Fhkry/refs/heads/main/elf.json. After a 200ms delay, the code iterates the fetched JSON and issues w:mex IQ queries with query_id 7871414976211147 and newsletter_id mutations against the user's session. A second helper generateMessageV base64+XOR(23)-decodes the string '@newsletter' and is wired to the same hardcoded query_id 7871414976211147 — two independent obfuscated paths whose sole purpose is to hide newsletter-mutation behavior. The remote list is fetched from a mutable `main` branch with no integrity check, so the author can change which newsletters every consumer's WhatsApp session follows at any time. Any application that requires this fork and calls makeWASocket() becomes an unwitting newsletter-amplification node for the attacker. Additional context: requestPairingCode() defaults customPairingCode to 'FHKRY666' (matches author's GitHub handle Fhkryyy and README Telegram link), confirming single-author attribution; deliberate String.fromCharCode and base64+XOR obfuscation of the URL and '@newsletter' string is conclusive evidence of intent to hide the behavior from consumers reading the source.
## Source: ghsa-malware (5c047564f8704cdeb929df6f89ae3575998b8e88ddb84146b026125b4cc055cf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.