Research

105 Baileys forks on npm that quietly make WhatsApp accounts follow channels

Between Sep 1, 2025 and Oct 21, 2026, 105 npm packages republished the Baileys WhatsApp library with hidden extras. Most of them use the developer's own WhatsApp session to follow channels picked by a remote list.

Published LPM Firewall research

Summary

  • 105 packages and 464 versions, published between Sep 1, 2025 and Oct 21, 2026, most of them since August 2026.
  • In 57 packages, the evidence describes the WhatsApp account following channels it was never asked to follow.
  • 32 hide code behind obfuscation, such as URLs rebuilt from character codes or a single eval expression several megabytes long.
  • 3 delete the project's own @whiskeysockets/baileys during install and point it at the fork.
  • LPM's own review confirms 38 of them as malicious. The other 67 are blocked on an OpenSSF/OSV malicious-package advisory.

What Baileys is, and why forks matter

Baileys (@whiskeysockets/baileys) is a widely used open-source library for building WhatsApp bots on WhatsApp Web. Many bot developers install forks that are republished under other names and promise extra features. A fork runs inside the bot with its logged-in WhatsApp session, so whatever the fork adds can act as that account.

How the channel-follow code works

  1. The bot creates a socket and connects to WhatsApp as usual.
  2. The fork's newsletter module schedules a background task. Several forks wait about 90 seconds before it runs.
  3. The task decodes a hidden URL, downloads a JSON list of channel IDs, and sends a follow request for each one using the bot's authenticated session.
  4. Errors are swallowed, so nothing shows up in the bot's logs.

The list sits on a file host or a GitHub repository the publisher controls, so the publisher decides which channels every installed bot follows, and can change it at any time. Some forks hard-code the channel IDs instead. In 6 packages, media messages the bot sends also carry metadata that credits a specific channel.

Other changes we found

  • A destination URL rebuilt from character codes inside the message-sending code, pointing at a host that is not part of WhatsApp.
  • A fingerprint of the machine posted to the publisher on every connection, with a server-side switch that can disable the installation.
  • A checkBan helper that sends the user's phone number to an unrelated third-party host.
  • A single module run through an obfuscator while the rest of the library stays readable, and in one package a JSFuck-style eval of about 6 MB that its postinstall script runs.
  • Install scripts that remove @whiskeysockets/baileys from node_modules and redirect it to the fork, so code that imports the original library gets the fork instead.

Indicators

Remote channel lists

  • https://files.gifted.co.ke/file/chJids.json
  • https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json
  • https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json
  • https://raw.githubusercontent.com/travatiger/MrLegend/refs/heads/main/Chids.json
  • https://raw.githubusercontent.com/iyedahruss/all-public-db/refs/heads/main/newsletter.json

Other hosts in the forks

  • https://bailey.crysnovax.link/api/v1/verify (machine fingerprint on every connect)
  • https://fiora.nixel.my.id/ (hidden in the message-send code)
  • https://xzc-corporation.biz.id/lrp?number= (receives the user's phone number)

Not every fork is the same

The forks share a name and a pattern, not necessarily a publisher. LPM's own review confirms 38 packages as malicious. For the other 67, the block rests on an OpenSSF/OSV advisory, and in some of those LPM's review found risky behavior without confirming malicious intent. Each report shows which applies, and the list below marks every package as LPM confirmed or advisory.

What to do

  • Use the upstream @whiskeysockets/baileys, or a fork whose changes you have reviewed.
  • Search package.json files and lockfiles for the names below.
  • If a bot ran one of them, check which channels its WhatsApp account follows and unfollow the ones you did not choose. Review the account's linked devices as well.
  • Delete node_modules and reinstall from a clean lockfile, because some forks replaced @whiskeysockets/baileys on disk.

Affected packages

105 packages. Each name links to its LPM Firewall report.

How we identified the packages

The list covers every npm package LPM Firewall blocks with baileys in its name, as of Oct 23, 2026. The counts of each behavior come from LPM's reviews and the advisory text for each package, so they are lower bounds.

Read how LPM Firewall reports are produced, or browse more research.