Malicious Code Injection in @celestial-community/baileys: Unauthorized WhatsApp Channel Subscriptions
Summary
MAL-2026-17438: Malicious code in @celestial-community/baileys (npm). Affects @celestial-community/baileys versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @celestial-community/baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp Web API. It allows developers to build applications that can send and receive messages, manage contacts, and utilize various WhatsApp features. However, this package has been compromised by the publisher, who injected malicious code that exploits the user's authenticated WhatsApp session without their consent.
Vulnerability Detail
The vulnerability arises from the injection of malicious code that utilizes the installer's WhatsApp session to subscribe to various WhatsApp Channels (newsletters) chosen by the publisher. This is achieved through three independent follow routines that execute without user consent, sending unauthorized FOLLOW queries to the WhatsApp API. The injected code is designed to operate covertly, inflating the publisher's channel subscribers while keeping the victim unaware of the actions being taken with their account.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @celestial-community/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the compromised package until a secure version is released. Additionally, consider using alternative libraries for WhatsApp Web API interactions that have not been reported as malicious.
Conclusion
The @celestial-community/baileys package has been compromised, leading to unauthorized actions taken on users' WhatsApp accounts. It is crucial for developers to stay informed about such vulnerabilities and take immediate action to secure their applications. Regularly updating dependencies and utilizing tools like Vulert can help in maintaining the security of your software.
See every vulnerability recorded for @celestial-community/baileys →
FAQ
The malicious code in @celestial-community/baileys allows the publisher to subscribe the user's WhatsApp account to various channels without their consent.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
The primary consequence is the unauthorized use of the victim's WhatsApp account to inflate the publisher's channel subscribers, which can lead to privacy concerns and loss of trust.
The best way to remove the malicious code is to uninstall the compromised package and replace it with a secure alternative. Ensure to update your dependencies accordingly.
If you have used the compromised package, immediately stop using it, update to a secure version if available, and monitor your WhatsApp account for any suspicious activity.
