Malicious Code Injection in @bellaxchuu/belbails: Covert WhatsApp Channel Subscription
Summary
MAL-2026-17342: Malicious code in @bellaxchuu/belbails (npm). Affects @bellaxchuu/belbails versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @bellaxchuu/belbails is part of a larger family of forks derived from the Baileys WhatsApp Web library. This library is designed to facilitate interactions with the WhatsApp Web API. However, this specific package has been identified as malicious, injecting covert actions into the WhatsApp socket layer, which can lead to unauthorized channel subscriptions.
Vulnerability Detail
The vulnerability stems from the package's ability to inject malicious code that issues an authenticated 'w:mex' FOLLOW query against attacker-chosen WhatsApp Channel/Newsletter JIDs. This occurs using the installer's own authenticated WhatsApp session, allowing the attacker to silently subscribe the victim's account to channels without consent. The malicious code employs various obfuscation techniques to hide the target JIDs, making it difficult for users to detect the malicious behavior. The vulnerability does not exfiltrate credentials or execute arbitrary remote code, but it does abuse the user's authenticated session for nefarious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @bellaxchuu/belbailsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can monitor your application's dependencies and ensure that you are not using any versions of @bellaxchuu/belbails. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The @bellaxchuu/belbails package poses a significant risk due to its malicious code that subscribes users to unwanted WhatsApp channels. Users are advised to uninstall the package and monitor their dependencies for vulnerabilities using tools like Vulert.
See every vulnerability recorded for @bellaxchuu/belbails →
FAQ
The main issue is that it injects malicious code that subscribes users to WhatsApp channels without their consent.
The code issues an authenticated FOLLOW query using the user's WhatsApp session, targeting hidden JIDs.
No, the vulnerability does not exfiltrate credentials; it only abuses the authenticated session for channel subscriptions.
No, there is currently no patched version available. It is advised to uninstall the package completely.
You can use Vulert, which monitors your package-lock.json for vulnerabilities in real-time. Visit https://vulert.com for more information.
