What happened

GitHub's advisory database and OSV have listed 20 npm packages with baileys in their names as malware. For 15 of them, GitHub's entries describe forks of the Baileys WhatsApp Web library that quietly sign the installer's own WhatsApp account up to channels the publisher chose. Most of the GitHub entries appeared on 5 November, and those for @smart-dev-wa/baileys and oktz-baileys followed on 6 November.

When the library's WhatsApp connection opens, the added code sends a follow request through the victim's logged-in session without telling them. Some of the packages, including aemeath-baileys and lunaaa-baileys, also mute the channel straight after following it so it goes unnoticed. Fifteen of GitHub's entries say the package behaves the same as the PhantomSub family, and the oktz-baileys entry dates OX Security's write-up of that campaign to 28 September 2026.

OSV's review of @smart-dev-wa/baileys found nothing that ships WhatsApp credentials or session keys elsewhere, no payload at install time and no persistence. It describes the harm as covert use of the victim's account to boost the publisher's channel subscriber numbers. GitHub's advisory for @smart-dev-wa/baileys says any computer that installed or ran it should be treated as fully compromised.

Timeline

  1. OX Security documents the PhantomSub campaign.[2]

  2. GitHub publishes malware advisories for most of the Baileys forks.[3]

  3. GitHub adds advisories for @smart-dev-wa/baileys and oktz-baileys.[1]

What to do

  1. Remove the package, bearing in mind that removing it may not undo everything it did.
  2. From a different computer, rotate the secrets and keys that were stored on the affected machine.

Packages named

Named in the source, not checked: this brief has a single source so far. Cloak Watch looks for these once more sources confirm it.

EcosystemPackageVersions
npm@smart-dev-wa/baileys1.0.0
npmoktz-baileysAll versions
npm@monze1239/baileys1.0.01.0.1
npmichigokurosaki-baileys1.0.0
npm@denzz221/baileys2.0.07.0.08.0.58.0.68.0.88.1.18.1.28.1.38.1.58.1.68.1.7
npm@alannxds/baileys6.2.10
npm@zaxius/baileys1.0.1
npm@dyllxnn/baileys1.0.0
npm@raffnotdev/baileys1.0.0
npm@lekzox/baileys0.0.1
npmaemeath-baileys1.1.13
npmkevinx-baileys1.2.01.2.11.2.2
npmlunaaa-baileys1.1.01.1.19.0.229.0.23
npmndraawzz-baileys1.5.0
npm@sakataa/baileys1.0.02.0.03.0.0
npmruby-baileys1.5.171.5.18
npm@zyrennofficiall/baileys5.1.05.2.05.3.05.4.05.5.0
npmzero2-baileysAll versions
npm@exclipz/baileysAll versions
npmcanta-baileys1.1.13

Indicators of compromise

Shown defanged so they can't be clicked. Copy copies the real value. Every indicator appears in the cited source.

TypeIndicatorNoteCopy
SHA-2567afa059f55b913a2b78dfcaf0a14adec87a494e166b9c1b4308df9f1eca580f0SHA-256 of the published @smart-dev-wa/baileys 1.0.0 npm tarball[18]
URLhxxps://raw[.]githubusercontent[.]com/FallEzz/baileys-corp/refs/heads/main/news.jsonchannel list canta-baileys downloads at runtime[21]

Sources

  1. GitHub Advisory Database · Malware in @smart-dev-wa/baileys
  2. GitHub Advisory Database · Malicious code in oktz-baileys (npm)
  3. GitHub Advisory Database · Malicious code in @monze1239/baileys (npm)
  4. GitHub Advisory Database · Malicious code in ichigokurosaki-baileys (npm)
  5. GitHub Advisory Database · Malicious code in @denzz221/baileys (npm)
  6. GitHub Advisory Database · Malicious code in @alannxds/baileys (npm)
  7. GitHub Advisory Database · Malicious code in @zaxius/baileys (npm)
  8. GitHub Advisory Database · Malicious code in @dyllxnn/baileys (npm)
  9. GitHub Advisory Database · Malicious code in @raffnotdev/baileys (npm)
  10. GitHub Advisory Database · Malicious code in @lekzox/baileys (npm)
  11. GitHub Advisory Database · Malicious code in aemeath-baileys (npm)
  12. GitHub Advisory Database · Malicious code in kevinx-baileys (npm)
  13. GitHub Advisory Database · Malicious code in lunaaa-baileys (npm)
  14. GitHub Advisory Database · Malicious code in ndraawzz-baileys (npm)
  15. GitHub Advisory Database · Malicious code in @sakataa/baileys (npm)
  16. GitHub Advisory Database · Malicious code in ruby-baileys (npm)
  17. GitHub Advisory Database · Malicious code in @zyrennofficiall/baileys (npm)

Changelog

  1. First published.