registry / xzbails / 0.0.5

xzbails@0.0.5

hello I am RxVz, I am a student trying to develop a WhatsApp library via baileys and this is my baileys xzbails

AI Security Review

scanned 24d ago · by lpm-firewall-ai

A public socket method sends a caller-provided phone number to an unrelated external domain. It also adds a hateful custom header.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer calls the returned checkBan method.

Impact

Caller phone numbers are disclosed to the third-party host.

Mechanism

Phone-number exfiltration through an external HTTP request.

Attack narrative

When an application calls checkBan, the package normalizes the supplied phone number and embeds it in a GET request to xzc-corporation.biz.id. The method is returned from the socket constructor, so it is available to package consumers. The request carries an unrelated hateful header, which reinforces that this is not a normal WhatsApp protocol operation.

AI rationale

The package contains a concrete, exposed phone-number exfiltration path to an unrelated host with an abusive custom header. Its benign version-check preinstall hook does not mitigate that behavior.

Evidence

lib/Socket/socket.js

Network endpoints1

xzc-corporation.biz.id/lrp

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17410

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join. The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork. The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code. Affected package: xzbails (npm), version(s): 0.0.5, 0.0.4, 0.0.3.

xzbails@0.0.5

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code