sea-baileys

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (2aaf4b5ddb859270a86aa6d21df680ed66fb0622434317747a6f7275ad9a3d60)
sea-baileys is a fork of the Baileys WhatsApp Web library. Its package.json remaps the `libsignal` import specifier to `npm:@otaxayun/libsignal-node@latest` — an unrelated maintainer's package pinned to the mutable `latest` dist-tag rather than a fixed version or integrity hash. lib/Signal/libsignal.js routes the installer's Signal Protocol identity private key, signed pre-key private key, session records and sender keys through this dependency, so whatever code `@otaxayun/libsignal-node` resolves to at install time handles the consumer's WhatsApp cryptographic identity and message stream. Because the tag is mutable and owned by a third party outside the sea-baileys publisher, a single publish under that name replaces the crypto implementation on every subsequent `npm install`. Separately, lib/Utils/messages-media.js's prepareWAMessageMedia unconditionally attaches a hardcoded `annotations` block referencing the newsletter JID `120363409928671192@newsletter` ("HOSHINO AI INFORMATION") to every outgoing media message when the caller does not supply annotations, silently modifying consumer-generated WhatsApp payloads to advertise the fork author's channel.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4fde7bacf977b70979f76b1c0f9f1ca974b017b8/osv/malicious/npm/sea-baileys/MAL-2026-16473.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/4fde7bacf977b70979f76b1c0f9f1ca974b017b8/osv/malicious/npm/sea-baileys/MAL-2026-16473.json
- https://www.npmjs.com/package/sea-baileys/v/1.0.2
- https://github.com/advisories/GHSA-9xjg-g5r3-xpj8

Compromised versions (1)

• = 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.