@zeronexcode/baileys

GHSA-h49v-c54j-rfw2

Malicious code in @zeronexcode/baileys (npm)

Details

**Severity:** Critical

**Affected versions:** `= 7.0.0-zeronex.8`

makeWASocket() in lib/Socket/index.js makes the user's WhatsApp account follow the hardcoded channel 120363427099186895@newsletter whenever a connection opens, with no option to disable it.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/000f4379ed4c103cbbf67c1deb4c50869bb7fdf7/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/000f4379ed4c103cbbf67c1deb4c50869bb7fdf7/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json
- https://github.com/ossf/malicious-packages/blob/72394477b395764c28acdd932236d25fca79ced6/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json
- https://github.com/ossf/malicious-packages/blob/2bb9370d891283643f919e860abea2cc197b0b3b/osv/malicious/npm/@zeronexcode/baileys/MAL-2026-17326.json
- https://www.npmjs.com/package/@zeronexcode/baileys/v/7.0.0-zeronex.8
- https://github.com/advisories/GHSA-h49v-c54j-rfw2

Compromised versions (1)

= 7.0.0-zeronex.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.