turbo-baileys

MAL-2026-19022

Malicious code in turbo-baileys (npm)

Details

turbo-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://files.gifted.co.ke/file/chJids.json, https://turbo-cdns.vercel.app/files/turbowajids.json, https://www.image2url.com/r2/default/files/1780687002364-b57976c9-0469-4f22-9b68-d6413608cc1c.json (the URL itself stored as base64 strings), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).

Compromised versions (6)

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.