@ubedsockets/baileys

Details

Malicious package. `@ubedsockets/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363410154606795@newsletter, 120363423295236859@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious. Detected by wormsign static analysis of the injected channel-subscription code.

Compromised versions (26)

• 1.0.0
• 1.1.0
• 1.2.0
• 1.3.0
• 1.4.0
• 1.5.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.7.0
• 1.7.1
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.2
• 1.7.3
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.9

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.