kevinx-baileys
KevinX Baileys — a WebSockets library for interacting with WhatsApp Web (multi-device, pairing code, interactive messages, newsletter, auto-reconnect, send queue, typings).
This report shows the evidence for kevinx-baileys@1.2.2. 3 of 3 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 17m ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18688 confirms this npm version as malicious.
Advisory
MAL-2026-18688
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in kevinx-baileys (npm)
Details
kevinx-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363408893555851@newsletter, 120363424295522327@newsletter, 120363426470081124@newsletter, 120363427718144294@newsletter (stored base64-encoded), using the victim's authenticated session and without telling them; the README says "Nothing is followed unless you call it." 1.2.1 was published one directory down (kevinx-baileys/lib/Socket/newsletter.js) under a placeholder package.json whose main, index.js, does not exist, so importing it by name fails, but it ships the same follow code; 1.2.2 restores the normal layout with the same lib/Socket/newsletter.js. Same behaviour as the PhantomSub family (MAL-2026-17342).
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The install hook only enforces the package's Node.js requirement, and import-time update checks are opt-in. Credential-bearing GraphQL requests use WhatsApp endpoints, while channel follows require an explicitly supplied target list.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installation runs a Node.js version check; runtime network and account actions occur through the WhatsApp library's invoked APIs, with channel following requiring a nonempty caller-provided list.
Impact
No unauthorized collection, unrelated credential transfer, or default account action was identified.
Mechanism
The preinstall hook checks the Node.js major version. Optional update checking is opt-in, WhatsApp GraphQL calls target WhatsApp hosts, and the hard-coded newsletter identifier is used as message metadata.
AI rationale
The install hook only enforces the package's Node.js requirement, and import-time update checks are opt-in. Credential-bearing GraphQL requests use WhatsApp endpoints, while channel follows require an explicitly supplied target list.
Network endpoints4
graph.whatsapp.comacs.whatsapp.comwamo.whatsapp.netregistry.npmjs.org
Independent scan evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The preinstall script only runs a Node.js version check and exits if the version is below 20.
- Importing the main entry shows a banner; update checks run only when explicitly enabled by an environment flag.
- Automatic channel follows require a caller-supplied list, which defaults to empty.
- GraphQL requests use WhatsApp endpoints; Wamo credentials are passed through the Wamo request path.
- The hard-coded newsletter identifier appears in event message metadata that is relayed by a message-building method.
Evidence against
- The package does define a preinstall lifecycle script, but it only checks the Node.js version.
- The library supports account actions and credential-bearing requests when its WhatsApp socket methods are invoked. The reviewed code does not show unrelated automatic collection or default account actions.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
WAProto/index.js11.6 MB file, sampled 256 KB
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L600lib/Utils/validate-connection.jsView file
107pull: false,
L108: devicePairingData: {
L109: buildHash: appVersionBuf,
...
L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content);
L135: let hmacPrefix = Buffer.from([]);
L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) {
...
L158: ]);
L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg);
L160: const identity = createSignalIdentity(lid, accountSignatureKey);
Low
Weak Crypto
Package source references weak cryptographic algorithms.
lib/Utils/validate-connection.jsView on unpkg · L107WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh
kind = build_helper
sizeBytes = 302
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 12145764
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/business.jsView file
•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
lib/Utils/business.jsView on unpkglib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = @mrfurryofc/baileys@1.0.3
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:QG1yZnVycnlvZmMvYmFpbGV5cw:1.0.3
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages-media.jsView on unpkgFindings
5 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighSemantic Analysis Limitedlib/Utils/business.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptolib/Utils/validate-connection.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to kevinx-baileys@1.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing kevinx-baileys@1.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.