luna-baileys@9.0.26
OpenSSF/OSV Malicious Advisory
imported 2d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18520 confirms this npm version as malicious.
Advisory
MAL-2026-18520
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in luna-baileys (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent scan evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Oversized source lightweight scan
WAProto/index.js5.51 MB file, sampled 256 KB
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/Voip/worker-bootstrap.jsView file
336const code = fs.readFileSync(url, "utf8");
L337: eval(code);
L338: }
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/Voip/worker-bootstrap.jsView on unpkg · L336src/Utils/auth-store.jsView file
17try {
L18: const mod = await import(name);
L19: return mod.default ?? mod;
Medium
Findings
4 High7 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis LimitedWAProto/index.js
HighKnown Malware Source Similaritysrc/Voip/audio-feeder.js
HighKnown Malware Source Similaritysrc/Voip/video-feeder.js
MediumDynamic Requiresrc/Utils/auth-store.js
MediumUnsafe Vm Contextsrc/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulesrc/assets/wasm/whatsapp.wasm
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalsrc/Voip/worker-bootstrap.js
Affected versions and remediation
This report applies to luna-baileys@9.0.26.
See all versions of luna-baileys for other recorded verdicts.
- Avoid installing luna-baileys@9.0.26. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.