@sanzoffc/baileys

GHSA-grqc-r63w-6845

Malicious code in @sanzoffc/baileys (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.0.4`

## Source: amazon-inspector (4393cd98419ed1fce683c0fde038bce830873769d85d69e64674df61f68502bc)
This package is a fork of the Baileys WhatsApp library that adds covert remote-controlled behavior driven by the installer's authenticated WhatsApp session. In lib/Socket/socket.js, socketConnect() (invoked from validateConnection on every WebSocket open) reconstructs a URL from a String.fromCharCode char-code array that resolves to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, fetches that JSON list, and iterates it to issue WhatsApp GraphQL mutations with query_id 7871414976211147 (newsletter subscribe/follow) for each id in the remote-supplied list. The list is hosted on a mutable personal-GitHub branch controlled by a third party, so whoever edits that file determines which actions the installer's WhatsApp account performs. A second helper (generateMessageV) base64+XOR-decodes (key 23) a hardcoded '@newsletter' JID and pairs it with the same query_id 7871414976211147, then schedules the same subscription action 40 seconds after invocation - layered string obfuscation of a fixed destination JID that has no legitimate purpose in a WhatsApp protocol library. The behavior is not documented, not caller-configurable, and the URL and JID are deliberately obfuscated to evade string scanners. The manifest additionally declares '@whiskeysockets/eslint-config' as an unpinned github: source and pins most other dependencies to '*', widening the resolution trust boundary.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/01661bda345973d56fc415daab32e42ead2cd872/osv/malicious/npm/@sanzoffc/baileys/MAL-2026-16281.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/01661bda345973d56fc415daab32e42ead2cd872/osv/malicious/npm/@sanzoffc/baileys/MAL-2026-16281.json
- https://www.npmjs.com/package/@sanzoffc/baileys/v/3.0.4
- https://github.com/advisories/GHSA-grqc-r63w-6845

Compromised versions (1)

= 3.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.