Malicious code in plogme (npm)
plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys (MAL-2026-15917), and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js (javascript-obfuscator output, identical to the file in MAL-2026-15917) hardcodes the publisher's WhatsApp newsletter channels 120363423670814885@newsletter and 120363402922206865@newsletter and exports followCrysnovaxTrustedChannels(); lib/Socket/socket.js invokes it from the connection.update handler, so the user's own authenticated WhatsApp account silently follows both channels on every successful connection, with no opt-out. lib/Utils/integrity.js hashes hostname, platform, arch, cpu model and Node version into a machine fingerprint and POSTs it with the package identity to https://bailey.crysnovax.link/api/v1/verify on every socket connect. The obfuscated follow module was decoded, not executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (119fcc6129acfa344451ddc3153a9f5215ec2a2c9650a8cb891efc29e774f5f1) The package was found to contain malicious code or consuming dependency that contains malicious code
MAL-2026-16199
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16199
plogme
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions1.0.1Source reference:
/affected/0/versions1.0.2Source reference:
/affected/0/versions1.0.3Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "plogme",
"purl": "pkg:npm/plogme",
"ecosystem": "npm"
},
"versions": [
"1.0.0",
"1.0.1",
"1.0.2",
"1.0.3"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/plogme/MAL-2026-16199.json",
"indicators": {
"evidence_files": [
{
"path": "lib/Utils/channel-policy.js",
"tlsh": "5a8174a99a411e8113c30bd33a37b4d6f27460ee35c48a4afb306991be9f151f4c6672",
"sha256": "ee0dc4f66c39603e12b014cc09bee260bb80b9bbfe3d2f1428faccf95bebfec3"
},
{
"path": "lib/Utils/integrity.js",
"tlsh": "8d32babb16a216252a8385ae875a504b7b1cb4133219a8647c5eb3187fcc4b483f7ff1",
"sha256": "c55caba2bdf737f29b600fddc87392eab1de8c9f6626afb4225c028b40841814"
},
{
"path": "engine-requirements.js",
"tlsh": "6441857859a9033176c2d2aca903a0c5af59b01b3220c97139ff72086fdf8604177377",
"sha256": "7ce6486b989a6b1c52012e1c9a39e791d034e1a009b1356444e54b65fa772c47"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "d6d4efcfce7c22a11a4e519634848ca8db14b166",
"sha512_sri": "sha512-9W327k/K7FsffFAbvlcJKu3xj52vvKd2MhOf+NQ6yf2E8G3sNZQM/bwovbGtrrwB7LyrIStxEgHjzBf5/pVAJA=="
},
"filename": "plogme-1.0.2.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33428 · Revision 1
- Added to Heist Feed
- Publisher date