alya-baileys

MAL-2026-4478

Malicious code in alya-baileys (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (473103f2220a0215abf49be7e46ec1748052935ce188e0eee6ded08af7b47cf1)
alya-baileys is a fork of the Baileys WhatsApp library that adds a hidden, remotely-controlled action channel against the installer's authenticated WhatsApp session. In lib/Socket/newsletter.js, on every `connection.update` where the connection opens, the package decrypts an AES-256-CBC-encrypted URL (built from hex-chunk passphrase material in lib/Utils/alya.js that decodes to 'Alyabaileys' and a 'raw.githubcontent.com' host) via `alyaDecryptCore` and fetches author-controlled configuration with axios. That config drives three classes of action on the user's WhatsApp account: auto-following newsletters, auto-reacting (random or keyword-mapped emojis) to every message in any newsletter marked 'enabled' in the remote config, and auto-voting in polls with a configurable strategy ('random'/'first'/'last'). Only auto-follow is mentioned in the README; the auto-react and auto-vote behaviors are undisclosed. The remote endpoint can change targets and behavior at any time post-install, giving the author a persistent runtime channel to direct the installer's authenticated WhatsApp identity. Intent is reinforced by deliberate obfuscation: AES-encrypted URLs and JIDs decrypted at runtime, hex-chunk-built passphrases, five no-op aliased requires of `./Utils/alya` (`hapus_aja`, `gak_penting_asli`, `_apacoba_wkwk`,...) that exist only to confuse review, and a literal comment in newsletter.js line 200: `// You'll never find what this does - Ibra Decode`. The package name impersonates the well-known `baileys` / `@whiskeysockets/baileys` library and re-exports the same public API (`makeWASocket`, `useMultiFileAuthState`), increasing the chance an installer adopts it unintentionally.

Compromised versions (8)

1.9.36
1.9.45
1.9.35
1.9.42
1.9.39
1.9.46
1.9.38
1.9.37

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.