@systemzero/baileys

GHSA-qhhx-6r5v-mv3q

Malicious code in @systemzero/baileys (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.2`

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller's authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/0f162ab9d21461bd70de49ebaa4c1700bbbe95db/osv/malicious/npm/@systemzero/baileys/MAL-2026-15820.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/0f162ab9d21461bd70de49ebaa4c1700bbbe95db/osv/malicious/npm/@systemzero/baileys/MAL-2026-15820.json
- https://osv.dev/vulnerability/MAL-2026-13929
- https://osv.dev/vulnerability/MAL-2026-13932
- https://www.npmjs.com/package/@systemzero/baileys
- https://github.com/ossf/malicious-packages/blob/b2e6cd8bd1819c59f7afadfef27650fd124f3de2/osv/malicious/npm/@systemzero/baileys/MAL-2026-15820.json
- https://www.npmjs.com/package/@systemzero/baileys/v/1.1.2
- https://github.com/advisories/GHSA-qhhx-6r5v-mv3q

Compromised versions (1)

= 1.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.