Malicious code in @nexustechpro/baileys (npm)

{
  "id": "fffbc4519a37e877cc67fd5523c3fa7c9e1f32118d724701b8618a52b4ef33b7",
  "url": "https://osv.dev/vulnerability/MAL-2026-16104",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @nexustechpro/baileys (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (77e10f9b682c7a34a63468b31a47d982a98bf6d0308b5dbe96b0df7bdb51fdd6) @nexustechpro/baileys is a fork of the Baileys WhatsApp library in which lib/Socket/chats.js (~270 KB) is transformed with obfuscator.io (large string-array with rotate loop, decoder wrapper, hex-escaped identifiers) while every other module under lib/Socket/ is plain, readable code matching upstream. The obfuscated module is re-exported from lib/Socket/index.js and therefore loads on every require() of the package, executing inside a socket chain that has access to the authenticated WhatsApp session credentials, contact list, and message stream. In addition, on every 'connection.update' where connection==='open', the package silently subscribes the installer's authenticated WhatsApp account to a hardcoded newsletter JID (120363422827915475@newsletter) and re-applies the subscription every 30 seconds via setInterval; an AUTO_FOLLOW_FORCE_MODE flag bypasses the already-following check so a user-initiated unfollow is undone. There is no configuration surface, opt-out, or documentation for this behavior. package.json also declares an unpinned first-party-sounding dependency 'whatsapp-rust-bridge: latest'. The package name and keywords mirror the upstream @whiskeysockets/baileys ecosystem. ## Source: ghsa-malware (540ddb6572705d776d96d9199b385b55b45093ea3f9da298751ae13c289d924d) Any computer that has this package installed or r",
    "evidence": "osv:MAL-2026-16104",
    "products": [
      {
        "name": {
          "value": "@nexustechpro/baileys",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.2.7",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.2.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.2.4",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-16104",
      "aliases": [
        "GHSA-8w6v-4xp9-rvrr",
        "MAL-2026-16104"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@nexustechpro/baileys",
            "purl": "pkg:npm/%40nexustechpro/baileys",
            "ecosystem": "npm"
          },
          "versions": [
            "2.2.7",
            "2.2.5",
            "2.2.4"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nexustechpro/baileys/MAL-2026-16104.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "lib/Socket/chats.js",
                  "tlsh": "6d4464d04fd1a01361ce96afbf156ea8732bd352ea84b14761d77ac824eda43c360de1",
                  "sha256": "06dca1b96cbc00d05c321eb5a5a1647ad5a79c9c9f04e119d1319237c7caf049"
                },
                {
                  "path": "package.json",
                  "tlsh": "d9c11037ce88ce6306b173d9a5b50242f4580b4f1a90cc4f717d5bac8fb39072195b69",
                  "sha256": "b3348d098797d2eac851786dd728164056ac5e9ccf869c289023b342fb11c2d8"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "6b1725bcc55dc1b831e3655803c37726c2599497",
                    "sha512_sri": "sha512-awsZivZPtxV82WwuKFEY6VMLnDoISVChsaW4xQNyEKokWOi0deeIB4I3f199xHPUiDwDhTKj6pvfG/hC3655Ew=="
                  },
                  "filename": "baileys-2.2.7.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-13T07:45:14.761890745Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@nexustechpro/baileys/v/2.2.7",
        "https://github.com/advisories/GHSA-8w6v-4xp9-rvrr",
        "https://www.npmjs.com/package/@nexustechpro/baileys/v/2.2.5",
        "https://www.npmjs.com/package/@nexustechpro/baileys/v/2.2.4"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-019904",
            "sha256": "fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab",
            "source": "amazon-inspector",
            "versions": [
              "2.2.7"
            ],
            "import_time": "2026-09-09T22:38:09.680342884Z",
            "modified_time": "2026-09-09T22:27:09Z"
          },
          {
            "id": "GHSA-8w6v-4xp9-rvrr",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "540ddb6572705d776d96d9199b385b55b45093ea3f9da298751ae13c289d924d",
            "source": "ghsa-malware",
            "import_time": "2026-10-12T16:30:26.940867369Z",
            "modified_time": "2026-10-12T15:32:23Z"
          },
          {
            "id": "IN-MAL-2026-021466",
            "sha256": "77e10f9b682c7a34a63468b31a47d982a98bf6d0308b5dbe96b0df7bdb51fdd6",
            "source": "amazon-inspector",
            "versions": [
              "2.2.5"
            ],
            "import_time": "2026-10-13T07:32:01.557245622Z",
            "modified_time": "2026-10-13T06:54:14Z"
          },
          {
            "id": "IN-MAL-2026-021467",
            "sha256": "f36bbd92f268ccdeec610b1494add9a0bda52f78162c47d0666cc6aa12dcdad2",
            "source": "amazon-inspector",
            "versions": [
              "2.2.4"
            ],
            "import_time": "2026-10-13T07:32:01.5870231Z",
            "modified_time": "2026-10-13T06:54:24Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 307460,
  "published_at": "2026-09-09T22:27:09+00:00"
}