The @badzz88/baileys npm Supply Chain Attack

What happened

Forks of the Baileys WhatsApp library on npm used the installer's logged-in WhatsApp session. They followed channels that the package author picked. The OpenSSF malicious packages record MAL-2026-17341 describes this code in @badzz88/baileys.

According to that record, the injected code runs after the WhatsApp socket connects. It sends an authenticated w:mex FOLLOW query with query ID 7871414976211147. The result is that the victim's account joins channels it never asked to join. The record states that the target channel IDs are hidden. Some variants fetch the list from a remote file, so the targets can change after install.

The same record states three things. The code does not steal credentials. It does not set up persistence. It does not run arbitrary remote code. GitHub takes a stricter position. Its advisories class every version of the four packages as malware under CWE-506, Embedded Malicious Code. GitHub tells users to treat any computer with the package as fully compromised. It tells them to rotate its secrets from a different computer.

The OpenSSF record also has a second finding from Amazon Inspector. @badzz88/baileys depends on whatsapp-rust-bridge-baron. That package resolves to the default branch of a GitHub repository. An account other than the npm publisher owns that repository. The code that npm installs for that dependency can change between installs.

OX Security published its PhantomSub report on 28 September 2026. The report counts 101 packages with about 490,000 total downloads. It lists @badzz88/baileys with 52,173 downloads, the third highest in the campaign. OX Security reports that @badzz88/baileys and @sakataoffc/baileys both follow the channel 120363400362472743@newsletter.

OX Security describes three ways the forks get their channel lists. Some hardcode channel IDs in plain text. Some encode the IDs or invite codes in base64 and follow them after a delay. Others fetch a JSON list from GitHub at runtime. The OpenSSF pull request that added 76 of these reports was merged on 30 September 2026.

The npm registry shows that @badzz88/baileys first appeared on 7 January 2026 with version 4.0.0. The last real release was 8.6.0 on 29 September 2026. On 12 October 2026, npm replaced the package with version 0.0.1-security, a security holding package.

Affected versions

The OpenSSF record lists these versions of @badzz88/baileys as malicious. GitHub marks every version of each package as affected.

• @badzz88/baileys: OpenSSF record MAL-2026-17341 lists 8.4.9, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, 8.5.7, 8.5.9 and 8.6.0. GitHub advisory GHSA-884c-mw3w-x2wg covers all versions.
• @sakataoffc/baileys: GitHub advisory GHSA-jrm5-8gc9-77hx covers all versions. The registry shows releases from 1.0.0 on 23 August 2026 to 9.0.0 on 29 September 2026. It also lists 8.4.4 and 8.4.5 with dates of 18 July 2026.
• @chatunity/baileys: GitHub advisory GHSA-2vxg-pmhf-2c8r covers all versions. OpenSSF record MAL-2026-17287 lists 2.0.9, 3.2.0 and 3.2.1. That record describes a libsignal dependency on github:realvare/libsignal, an unpinned GitHub branch.
• alipclutch-baileys: GitHub advisory GHSA-7c8r-gc84-h9fv covers all versions. OX Security lists it in the PhantomSub campaign with 4,473 downloads.

OX Security lists 101 packages in total. Its full list is in the OX Security report linked below.

Indicators of compromise

These indicators come from the OpenSSF record and the OX Security report.

• WhatsApp channel 120363400362472743@newsletter, followed by @badzz88/baileys and @sakataoffc/baileys (OX Security).
• WhatsApp channel 120363400911374213@newsletter, followed by 10 packages in the campaign (OX Security).
• WhatsApp channel 120363427430697245@newsletter, followed by 8 packages in the campaign (OX Security).
• FOLLOW query ID 7871414976211147 (OpenSSF MAL-2026-17341)
• Unpinned dependency whatsapp-rust-bridge-baron, which resolves to github:7ucg/whatsapp-rust-bridge, in @badzz88/baileys (OpenSSF MAL-2026-17341)
• Unpinned dependency github:realvare/libsignal in @chatunity/baileys (OpenSSF MAL-2026-17287).
• Remote channel list https://raw.githubusercontent.com/skyzopedia/Screaper/refs/heads/main/idChannel.json (OX Security).
• Remote channel list https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json (OX Security).

How to check

List the installed versions of the four packages in each Node.js project. This command only reads the dependency tree.

npm ls @badzz88/baileys @sakataoffc/baileys @chatunity/baileys alipclutch-baileys

If the command prints a version for any of them, the project has the package. Next, search the installed files for the channel ID that two of the packages follow.

grep -rl "120363400362472743" node_modules

Also check your WhatsApp account. Open the Updates tab and look at the channels you follow. A channel that you did not choose is a sign that a fork ran with your session.

What to do now

1. Remove the package from every project with npm uninstall and the package name.
2. Replace it with the official Baileys package from its first maintainers. Pin the version in your lockfile.
3. In WhatsApp, unfollow every channel that you did not choose.
4. In WhatsApp, open Linked Devices and log out every session that the bot used. Then link the bot again with a clean library.
5. GitHub says to treat the computer as compromised. From a different computer, rotate the secrets and keys stored on the affected machine.
6. Block the remote channel-list URLs from the indicator list in your network or proxy rules.

What Vigilance would show (rebuilt from public reports)

Vigilance compares the version you trust with the new one and names the file that gained a new power. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 61

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    package.json
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. github.com/advisories/GHSA-884c-mw3w-x2wg
2. github.com/advisories/GHSA-jrm5-8gc9-77hx
3. github.com/advisories/GHSA-2vxg-pmhf-2c8r
4. github.com/advisories/GHSA-7c8r-gc84-h9fv
5. osv.dev/vulnerability/MAL-2026-17341
6. osv.dev/vulnerability/MAL-2026-17287
7. ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/
8. github.com/ossf/malicious-packages/pull/1563
9. registry.npmjs.org/@badzz88/baileys
10. registry.npmjs.org/@sakataoffc/baileys