plogme

GHSA-q276-hmjg-47qw

Malicious code in plogme (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys (MAL-2026-15917), and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js (javascript-obfuscator output, identical to the file in MAL-2026-15917) hardcodes the publisher's WhatsApp newsletter channels 120363423670814885@newsletter and 120363402922206865@newsletter and exports followCrysnovaxTrustedChannels(); lib/Socket/socket.js invokes it from the connection.update handler, so the user's own authenticated WhatsApp account silently follows both channels on every successful connection, with no opt-out. lib/Utils/integrity.js hashes hostname, platform, arch, cpu model and Node version into a machine fingerprint and POSTs it with the package identity to https://bailey.crysnovax.link/api/v1/verify on every socket connect. The obfuscated follow module was decoded, not executed.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/3786d51995002b20adfd3d23ef5e78f56516961a/osv/malicious/npm/plogme/MAL-2026-16199.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/3786d51995002b20adfd3d23ef5e78f56516961a/osv/malicious/npm/plogme/MAL-2026-16199.json
- https://osv.dev/vulnerability/MAL-2026-15917
- https://pkgwarden.com/incidents/baileys-whatsapp-auto-follow-npm-september-2026
- https://github.com/ossf/malicious-packages/blob/9b3ccbf4bfc4af3c2e53e9b0729d217beb12d481/osv/malicious/npm/plogme/MAL-2026-16199.json
- https://www.npmjs.com/package/plogme/v/1.0.0
- https://www.npmjs.com/package/plogme/v/1.0.1
- https://www.npmjs.com/package/plogme/v/1.0.2
- https://www.npmjs.com/package/plogme/v/1.0.3

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.