kevinx-baileys@1.2.1
OpenSSF/OSV Malicious Advisory
imported 11m ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18688 confirms this npm version as malicious.
Advisory
MAL-2026-18688
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in kevinx-baileys (npm)
Details
kevinx-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363408893555851@newsletter, 120363424295522327@newsletter, 120363426470081124@newsletter, 120363427718144294@newsletter (stored base64-encoded), using the victim's authenticated session and without telling them; the README says "Nothing is followed unless you call it." 1.2.1 was published one directory down (kevinx-baileys/lib/Socket/newsletter.js) under a placeholder package.json whose main, index.js, does not exist, so importing it by name fails, but it ships the same follow code; 1.2.2 restores the normal layout with the same lib/Socket/newsletter.js. Same behaviour as the PhantomSub family (MAL-2026-17342).
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The checkBan helper sends a caller-supplied phone number to a hard-coded host outside WhatsApp, with no source explanation of the service relationship or data handling. The request is explicit rather than automatic, so this is a privacy risk warranting a warning, not evidence of malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A caller invokes checkBan(number) on a created socket.
Impact
The external service receives the phone number; the source does not establish who operates the host or how it handles the number.
Mechanism
The helper strips non-digits and sends the number in a GET request to https://kyuux-r.indevs.in/api/check-whatsapp?phone=….
AI rationale
The checkBan helper sends a caller-supplied phone number to a hard-coded host outside WhatsApp, with no source explanation of the service relationship or data handling. The request is explicit rather than automatic, so this is a privacy risk warranting a warning, not evidence of malicious behavior.
Evidence
kevinx-baileys/lib/Socket/socket.js
Network endpoints1
kyuux-r.indevs.in/api/check-whatsapp?phone={normalizedNumber}
Independent scan evidence
public snapshotAI called this Suspicious at 79.0% confidence as Unknown with medium false-positive risk.
Evidence for AI warning decision
- Calling the exposed checkBan(number) helper sends the normalized phone number to the hard-coded host kyuux-r.indevs.in in a GET query.
- The helper is returned on the socket for callers to invoke; its request is not limited to WhatsApp endpoints.
Evidence against
- The preinstall hook only checks the Node.js major version and exits when it is below 20.
- Import prints a banner; its update check runs only when KEVINX_CHECK_UPDATE is enabled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Oversized source lightweight scan
Source & flagged code
10 flaggedkevinx-baileys/lib/WABinary/constants.jsView file
600patternName = google_api_key
severity = high
line = 600
High
High Secret
Package contains a high-severity secret pattern.
kevinx-baileys/lib/WABinary/constants.jsView on unpkg · L600600patternName = google_api_key
severity = high
line = 600
High
Secret Pattern
Google API key in kevinx-baileys/lib/WABinary/constants.js
kevinx-baileys/lib/WABinary/constants.jsView on unpkg · L600kevinx-baileys/lib/Utils/validate-connection.jsView file
107pull: false,
L108: devicePairingData: {
L109: buildHash: appVersionBuf,
...
L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content);
L135: let hmacPrefix = Buffer.from([]);
L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) {
...
L158: ]);
L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg);
L160: const identity = createSignalIdentity(lid, accountSignatureKey);
Findings
5 High6 Medium6 Low
HighHigh Secretkevinx-baileys/lib/WABinary/constants.js
HighShips High Entropy Blobkevinx_baileys_v1_2_1-1.2.1.tgz
HighSemantic Analysis Limitedkevinx-baileys/lib/Utils/business.js
HighKnown Malware Source Similaritykevinx-baileys/lib/Utils/messages-media.js
HighSecret Patternkevinx-baileys/lib/WABinary/constants.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperkevinx-baileys/WAProto/GenerateStatics.sh
MediumShips Compressed Blobkevinx_baileys_v1_2_1-1.2.1.tgz
MediumOversized Source Filekevinx-baileys/WAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to kevinx-baileys@1.2.1.
See all versions of kevinx-baileys for other recorded verdicts.
- Avoid installing kevinx-baileys@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.