@wanzlonely/bails4u
This report shows the evidence for @wanzlonely/bails4u@5.0.0. 4 of 7 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 23d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17381 confirms this npm version as malicious.
Advisory
MAL-2026-17381
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wanzlonely/bails4u (npm)
Details
This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
Affected package: @wanzlonely/bails4u (npm), version(s): 5.0.0, 4.0.0, 3.0.0, 2.0.0.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The automatic network probe is a real install-hook risk and warrants a warning. Static inspection did not establish malicious intent or a block-eligible attack chain.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
npm installation runs the postinstall script unless the skip environment variable is set.
Impact
Installation reveals that the installing host can attempt to reach WhatsApp; no confirmed broader attack surface was established.
Mechanism
The script creates a WebSocket connection to WhatsApp's chat endpoint and imports the package entrypoint for an integrity check.
AI rationale
The automatic network probe is a real install-hook risk and warrants a warning. Static inspection did not establish malicious intent or a block-eligible attack chain.
Evidence
package.jsonscripts/self-test.js
Network endpoints1
wss://web.whatsapp.com/ws/chat
Independent scan evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- The package registers preinstall and postinstall lifecycle commands.
- Its postinstall self-test automatically opens a WebSocket to WhatsApp before the consumer uses the library.
- The automatic check can be skipped only by setting an environment variable.
Evidence against
- The observed automatic connection targets WhatsApp rather than an unrelated operator endpoint.
- The lifecycle scripts do not show credential collection, filesystem mutation, payload download, or command execution beyond the declared checks.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
GitDependency
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/self-test.js || exit 0
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/self-test.js || exit 0
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600Findings
5 High8 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/antiban.js
HighSecret Patternlib/WABinary/constants.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirescripts/self-test.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
Affected versions and remediation
This report applies to @wanzlonely/bails4u@5.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @wanzlonely/bails4u@5.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.