Malicious code in itsmeeaizat-bailey (npm)

{
  "id": "5f766d0c97a7c9a74260c40dc3c28b5d9dd2fe0a8cb59d0f76f6c0737d88cb04",
  "url": "https://osv.dev/vulnerability/MAL-2026-17311",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in itsmeeaizat-bailey (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e87b4292727088efa5df8326a5f868b2c6bb3ae66ee15cecc18f2fa899296075) package.json declares the `libsignal` dependency as `git+https://github.com/whiskeysockets/libsignal-node` with no tag, no commit SHA, and no integrity constraint. On `npm install`, this resolves to whatever the default branch HEAD currently points at and executes any lifecycle scripts inside that fetched tree on the installer's machine — the delivered bytes and their behavior can change at any moment without a version bump to this package. Separately, the default socket factory in this Baileys fork wires an on-connection hook that, roughly 90 seconds after the installer's WhatsApp session opens, silently issues a FOLLOW MEX query for the hardcoded newsletter JID `120363400911374213@newsletter`, which is owned by the package author. The behavior is not documented in the README and is only disableable via an undocumented `autoFollowNewsletterOnConnect:false` option, so the installer's authenticated WhatsApp identity is used to perform a social reach-padding action they did not opt into. No credential theft, exfiltration to an author endpoint, backdoor, or install-time destructive action is present in the shipped code. ## Source: ghsa-malware (ad0a3b515c4f1cf22f0af3a8c2e905b8879ea3f6712d8dfb499587de27e6c417) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys st",
    "evidence": "osv:MAL-2026-17311",
    "products": [
      {
        "name": {
          "value": "itsmeeaizat-bailey",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.4",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.5",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17311",
      "aliases": [
        "GHSA-r64h-xc26-m8ww",
        "MAL-2026-17311"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "itsmeeaizat-bailey",
            "purl": "pkg:npm/itsmeeaizat-bailey",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.4",
            "1.0.3",
            "1.0.5"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/itsmeeaizat-bailey/MAL-2026-17311.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "package.json",
                  "tlsh": "6441ba24cc289eb305c526e8acba4102e57069538d44fc2c73c9432c8f8d15f7bbabad",
                  "sha256": "042cfd491fa93d75cbc274de488d0cea367a0a3f1b3862b7bb28e655a585b223"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "e66a37f396de0be47cd4fd0f3df4e2376a2b3035",
                    "sha512_sri": "sha512-/oa5I9aiTmqxMQDGsFvz23eCv6ol5siP7KdIA0k8eXqQFfk8mtiZXMqu/W2Gs0MWBMXtVZZ2woT5klENosG1WQ=="
                  },
                  "filename": "itsmeeaizat-bailey-1.0.4.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T13:45:05.310421879Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/itsmeeaizat-bailey/v/1.0.4",
        "https://www.npmjs.com/package/itsmeeaizat-bailey/v/1.0.3",
        "https://www.npmjs.com/package/itsmeeaizat-bailey/v/1.0.5",
        "https://github.com/advisories/GHSA-r64h-xc26-m8ww"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020789",
            "sha256": "aa89fc4b6ac9b670004406f8d95eee96891afc83758b023cf6fdeb23c70abcdc",
            "source": "amazon-inspector",
            "versions": [
              "1.0.4"
            ],
            "import_time": "2026-09-30T02:52:56.39972635Z",
            "modified_time": "2026-09-30T01:46:53Z"
          },
          {
            "id": "IN-MAL-2026-020788",
            "sha256": "d33df45ab827c11b7a27184ffdfe922765eaafb919cd6908cdc715453cadbeac",
            "source": "amazon-inspector",
            "versions": [
              "1.0.3"
            ],
            "import_time": "2026-09-30T02:52:56.295456306Z",
            "modified_time": "2026-09-30T01:46:43Z"
          },
          {
            "id": "IN-MAL-2026-020792",
            "sha256": "e87b4292727088efa5df8326a5f868b2c6bb3ae66ee15cecc18f2fa899296075",
            "source": "amazon-inspector",
            "versions": [
              "1.0.5"
            ],
            "import_time": "2026-09-30T02:52:56.775390735Z",
            "modified_time": "2026-09-30T01:47:20Z"
          },
          {
            "id": "GHSA-r64h-xc26-m8ww",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "ad0a3b515c4f1cf22f0af3a8c2e905b8879ea3f6712d8dfb499587de27e6c417",
            "source": "ghsa-malware",
            "import_time": "2026-10-08T13:33:19.405543644Z",
            "modified_time": "2026-10-08T13:21:49Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 99676,
  "published_at": "2026-09-30T01:46:43+00:00"
}