jexkcode

GHSA-g9xj-rjfw-h7h6

Malicious code in jexkcode (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter support but does not disclose this automatic account modification. Versions through 1.1.1 used a malformed newsletter JID; version 1.1.2 corrected it. Subsequent commits removed both failure and success logs, so version 1.1.4 performs the automatic follow without visible output. This behavior is unrelated to the package's stated functionality and modifies the user's WhatsApp account without authorization.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/634aa57654e42ba57dc297579bbca6dc0e263b8d/osv/malicious/npm/jexkcode/MAL-2026-16220.json))

**References:**
- https://github.com/jexkpinkman/JexkCode-baileys/commit/5cfbd91ad0caabcdf5e790b1e5de7afa730b56bf
- https://github.com/jexkpinkman/JexkCode-baileys/commit/8d412bfd2df5c0f2025fd89d12a5b1bfad186eca
- https://github.com/jexkpinkman/JexkCode-baileys/commit/d614aeffe4c386d09c29e39c7d9581dfca8c889a
- https://github.com/ossf/malicious-packages/blob/634aa57654e42ba57dc297579bbca6dc0e263b8d/osv/malicious/npm/jexkcode/MAL-2026-16220.json
- https://www.npmjs.com/package/jexkcode
- https://github.com/ossf/malicious-packages/blob/ce5aebcf135d19fafa94c24995d7ad8fac9d024d/osv/malicious/npm/jexkcode/MAL-2026-16220.json
- https://github.com/advisories/GHSA-g9xj-rjfw-h7h6

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.