@monze1239/baileys@1.0.0
A WebSockets library for interacting with WhatsApp Web.
OpenSSF/OSV Malicious Advisory
imported 3h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18679 confirms this npm version as malicious.
Advisory
MAL-2026-18679
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @monze1239/baileys (npm)
Details
@monze1239/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363413848171447@newsletter (stored base64-encoded), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The install hook is only a Node version check, and the inspected GraphQL transport uses WhatsApp endpoints. However, message handlers automatically add fabricated forwarding/newsletter metadata to outgoing messages, creating a user-visible deception risk; the evidence does not establish a direct account action against the embedded channel targets.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller uses `sendMessage` with album content, or invokes the event or poll-result handlers.
Impact
Recipients may be misled about a message’s origin or association. The inspected code does not establish an automatic follow, post to a channel, or credential transfer.
Mechanism
The handlers add hard-coded newsletter identifiers and false forwarding/context fields before relaying messages.
AI rationale
The install hook is only a Node version check, and the inspected GraphQL transport uses WhatsApp endpoints. However, message handlers automatically add fabricated forwarding/newsletter metadata to outgoing messages, creating a user-visible deception risk; the evidence does not establish a direct account action against the embedded channel targets.
Evidence
lib/Socket/messages-send.jslib/Socket/luxu.js
Network endpoints3
graph.whatsapp.comacs.whatsapp.comwamo.whatsapp.net
Independent scan evidence
public snapshotAI called this Suspicious at 83.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- The `preinstall` script only checks the Node.js major version and exits on versions below 20.
- When `sendMessage` receives an album, it automatically routes it through `handleAlbum`.
- `handleAlbum` adds fabricated forwarded-newsletter and message-context metadata to each album item before relaying it.
- Other message handlers also embed hard-coded newsletter identifiers in outgoing message metadata.
Evidence against
- GraphQL requests target WhatsApp hosts and use a token acquired through the socket’s nonce exchange.
- The main entry point’s visible import-time behavior prints package branding; it does not show an automatic account action.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
9 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600Findings
6 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighKnown Malware Source Fingerprint Signaturelib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
Affected versions and remediation
This report applies to @monze1239/baileys@1.0.0.
See all versions of @monze1239/baileys for other recorded verdicts.
- Avoid installing @monze1239/baileys@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.