The cloud-baileys npm Supply Chain Attack

What happened

A WhatsApp library on npm shipped malicious code in all 20 of its releases, over almost two months. The first release, 1.0.0, reached npm on 11 August 2026 at 11:02 UTC. The last release, 1.1.42, reached npm on 3 October 2026.

On 9 October 2026, GitHub published a malware advisory for the package. The advisory classes the weakness as CWE-506, Embedded Malicious Code. It lists no patched version. The advisory says that any computer that has this package installed or running must be treated as fully compromised. It tells users to rotate every secret and key on that computer from a different computer.

The npm registry record shows that npm took control of the package on 9 October 2026. The maintainer listed for the package is now npm. The latest tag points to 0.0.1-security, the npm security holding package. Versions 1.0.0 to 1.1.42 keep their publish times in the registry record, but their files are no longer available for download.

OX Security names cloud-baileys in its PhantomSub research. OX lists the package in the family it calls "WhatsApp Subscriber", with a status of Live and 2642 downloads at the time of writing. OX reports that the PhantomSub packages use the Baileys library inside the victim's own WhatsApp session. The packages add that account to WhatsApp groups and channels without consent. OX also reports that the operators mute these channels on the victim's device. The victim then does not see the new channels.

OX lists shared infrastructure across the campaign. The WhatsApp channel 120363400911374213@newsletter is followed by 10 packages. OX names cloud-baileys among them, together with @fazzcodestudio/wa-web, @japofc/baileys and @vanzxy/baileys.

The two sources differ in how serious they rate the package. OX describes channel and group subscription through the victim's WhatsApp account. GitHub treats the whole computer as compromised and tells users to rotate all secrets. No source this page cites names the file inside cloud-baileys that carried the code.

Affected versions

All 20 published versions of cloud-baileys are malicious, per the GitHub advisory. No clean version exists.

• 1.0.0, 1.0.1, 1.0.2, 1.0.3 (11 August 2026)
• 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2 (14 August 2026)
• 1.1.3 (15 August 2026)
• 1.1.33 (16 August 2026)
• 1.1.34 (18 August 2026), 1.1.35 (20 August 2026), 1.1.36 (26 August 2026)
• 1.1.37 (2 September 2026), 1.1.38 (4 September 2026), 1.1.39 (7 September 2026)
• 1.1.40 (11 September 2026), 1.1.41 (18 September 2026)
• 1.1.42 (3 October 2026)

The npm latest tag now points to 0.0.1-security. The registry also lists 0.0.0-stage. These placeholders are not clean releases of the original library.

OX Security lists 101 related Baileys packages in the same research. Some of them are @fazzcodestudio/wa-web, @japofc/baileys, @vanzxy/baileys, ourin-baileys and @nexustechpro/baileys. This page covers cloud-baileys only. Check the OX list if your project uses another Baileys fork.

Indicators of compromise

The main indicator is the package name cloud-baileys at any version from 1.0.0 to 1.1.42 in your dependency tree.

• Package: cloud-baileys, versions 1.0.0 to 1.1.42
• Advisory: GHSA-745p-g872-6x8c
• WhatsApp channel followed by cloud-baileys and 9 other packages, per OX Security: 120363400911374213@newsletter
• On your phone: WhatsApp channels or groups that you did not join, often muted

No source this page cites lists file hashes or network domains for cloud-baileys.

How to check

Run this command in each Node.js project folder. It lists any installed copy of cloud-baileys and its version.

npm ls cloud-baileys --all

If the command prints (empty), the project does not use the package. To check lock files across many projects at once, search them for the package name.

grep -rl --include=package-lock.json "node_modules/cloud-baileys" ~/

To look for the shared WhatsApp channel ID in installed code, search your node_modules folders.

grep -rl "120363400911374213@newsletter" node_modules

Then open WhatsApp on the phone that the bot used. Look in the Updates tab for channels that you did not follow. Look in your chat list for groups that you did not join.

What to do now

1. If any check finds cloud-baileys, stop the bot or app that uses it.
2. Follow the GitHub advisory. Treat the computer or server that ran the package as fully compromised.
3. From a different computer, rotate every secret and key that the affected computer stored. This includes npm tokens, cloud keys, SSH keys and API keys.
4. Remove cloud-baileys from package.json and the lock file. Use the official Baileys package or a fork that you trust.
5. Rebuild the affected computer or server from a clean image. The advisory says that removing the package does not guarantee that all malicious software is gone.
6. On the WhatsApp account that the bot used, log out all linked devices. Leave any channels and groups that you did not join.

What Vigilance would show (rebuilt from public reports)

Vigilance compares the version you trust with the new one and names the file that gained a new power. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 77

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    package.json
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. github.com/advisories/GHSA-745p-g872-6x8c
2. registry.npmjs.org/cloud-baileys
3. ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/