Malicious code in @dreamguyxeon/baileyx (npm)

{
  "id": "34cb5537451d8e870a612e5d5ecd53d16f5dca81cfa86c39beec3986e90b1111",
  "url": "https://osv.dev/vulnerability/MAL-2026-13930",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @dreamguyxeon/baileyx (npm)",
    "summary": "npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and silently FOLLOWs listed newsletter JIDs. Trigger is runtime (makeNewsletterSocket), not install. It also fetches Baileys version metadata from DGXeon13/dgxeon-soket and aliases libsignal to npm:@dgxeon13/libsignal-node@1.0.0 (a separate package that patches @whiskeysockets/baileys). Independently corroborated by LPM Firewall's public malicious report for 2.0.0. Related OSV entries: dgxeon-baileys (MAL-2026-2252), baileys-dgxeon (MAL-2025-806). Tarball sha256 for 5.0.0: 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a) This package is a fork of the Baileys WhatsApp library that contains an undocumented runtime hijack of the consumer's authenticated WhatsApp account. In lib/Socket/newsletter.js (lines 102-122), when the consumer creates a WhatsApp socket — the package's main advertised function — a 120-second setTimeout fires, fetches https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json, and for each newsletter ID in that list issues a QueryIds.FOLLOW reques",
    "evidence": "osv:MAL-2026-13930",
    "products": [
      {
        "name": {
          "value": "@dreamguyxeon/baileyx",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "4.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "5.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-13930",
      "aliases": [
        "GHSA-94fw-5xp7-q2xq",
        "MAL-2026-13930"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@dreamguyxeon/baileyx",
            "purl": "pkg:npm/%40dreamguyxeon/baileyx",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0",
            "2.0.0",
            "3.0.0",
            "4.0.0",
            "5.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dreamguyxeon/baileyx/MAL-2026-13930.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "lib/Socket/newsletter.js",
                  "tlsh": "c452965665fa5aa517a37054e67fb0e0b320f243782598673f8cd4020f4a1dde8b3bd8",
                  "sha256": "d46c64f770bf6f1d7220deb9c9d38e842ba022b8cd95cda654705ba8297e9abb"
                },
                {
                  "path": "lib/index.js",
                  "tlsh": "5e1352c4ffcc7dbec1d01e731077055effa91f400adb9a40a2e16dd0ab9ab4651aa918",
                  "sha256": "806b72da4e0047e5ee91e70676f14b1beea846996f6b45fe263a5963ef994c1a"
                },
                {
                  "path": "package.json",
                  "tlsh": "ff51ec25cc5cceb314c636e969ba0102907842534d95fc2c336c4bac4f5e25f72b9b2e",
                  "sha256": "d7e464dba8b1c3a596ae06af6e6f1864cc39a7d71ceb7e198bfcd891d05d1e88"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "6cf0315ebd8912eb1f1d0bd95d662f353f5fd544",
                    "sha512_sri": "sha512-XfvM96uEUGK4anRfSTsqV3Q6DfNXUwQOzVlO/8wvjfRTrEgEgvsunFnUkZMf+t8EB/6KUHXPf9mOzSzIWGXEgw=="
                  },
                  "filename": "baileyx-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-21T04:45:04.894099272Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@dreamguyxeon/baileyx",
        "https://osv.dev/vulnerability/MAL-2026-2252",
        "https://osv.dev/vulnerability/MAL-2025-806",
        "https://firewall.lpm.dev/npm/@dreamguyxeon/baileyx/v/2.0.0",
        "https://safedep.io/malicious-baileys-npm-whatsapp-campaign/",
        "https://www.npmjs.com/package/@dreamguyxeon/baileyx/v/1.0.0",
        "https://www.npmjs.com/package/@dreamguyxeon/baileyx/v/3.0.0",
        "https://www.npmjs.com/package/@dreamguyxeon/baileyx/v/2.0.0",
        "https://www.npmjs.com/package/@dreamguyxeon/baileyx/v/4.0.0",
        "https://www.npmjs.com/package/@dreamguyxeon/baileyx/v/5.0.0",
        "https://github.com/advisories/GHSA-94fw-5xp7-q2xq"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json",
            "https://raw.githubusercontent.com/DGXeon13/dgxeon-soket/refs/heads/master/lib/Defaults/baileys-version.json"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-017624",
            "sha256": "c1b873d1c35283cbabd9bc82c8bffa55d3151abec85a75522ed8565c93d0546a",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-08-13T15:26:42.818834673Z",
            "modified_time": "2026-08-13T14:58:19Z"
          },
          {
            "id": "IN-MAL-2026-017795",
            "sha256": "7ea8f669b9d0f75975bc9b1dd420bbaaade523baf2ac1bd4bc335e6007e10aa4",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-08-14T14:51:39.063994671Z",
            "modified_time": "2026-08-14T14:37:23Z"
          },
          {
            "id": "IN-MAL-2026-017800",
            "sha256": "9c19da8d5ae5dc169d9d584a1751cbc82ff809bf5d0866786805124a6993ecaa",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-08-14T14:51:39.399706035Z",
            "modified_time": "2026-08-14T14:38:18Z"
          },
          {
            "id": "IN-MAL-2026-017791",
            "sha256": "a033f5d103d84f240ca1f414b8906b3fa9f5d734e475ae0855cb4940c0875575",
            "source": "amazon-inspector",
            "versions": [
              "4.0.0"
            ],
            "import_time": "2026-08-14T14:51:38.811454662Z",
            "modified_time": "2026-08-14T14:36:44Z"
          },
          {
            "id": "IN-MAL-2026-017788",
            "sha256": "a40a1f6133c242f2ddfbdfa05b03e50ec3f9995e0de10d3dcd6f75343b5924c9",
            "source": "amazon-inspector",
            "versions": [
              "5.0.0"
            ],
            "import_time": "2026-08-14T14:51:38.621336442Z",
            "modified_time": "2026-08-14T14:36:20Z"
          },
          {
            "id": "GHSA-94fw-5xp7-q2xq",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "754cbf8aed43f593956c581a15ddfba2be14d4c0ae555a65c3955916f6412377",
            "source": "ghsa-malware",
            "import_time": "2026-10-21T04:30:05.226361076Z",
            "modified_time": "2026-10-21T04:23:18Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 391589,
  "published_at": "2026-08-10T22:30:00+00:00"
}