Malicious Code Vulnerability in @chatunity/baileys: Risk of Code Execution
Summary
MAL-2026-17287: Malicious code in @chatunity/baileys (npm). Affects @chatunity/baileys versions 3.2.0 – 3.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @chatunity/baileys package is a Node.js library designed for building chat applications using the WhatsApp Web API. It provides developers with tools to interact with WhatsApp's messaging features. However, this package has been found to contain a significant vulnerability due to its reliance on an off-registry git source for one of its dependencies, libsignal. This dependency can be altered without any integrity checks, posing a risk to users.
Vulnerability Detail
The vulnerability arises from the package.json file declaring a runtime dependency on 'libsignal' sourced from a mutable GitHub repository. This repository does not have a fixed commit SHA or tag, meaning that during 'npm install', the latest code from the default branch is fetched and executed. If malicious code is introduced into this repository, it will execute on every installation of the package, leading to potential unauthorized access or data manipulation. The lack of integrity checks means that there is no safeguard against such changes, making it a critical security risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @chatunity/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @chatunity/baileys package until a secure version is released. If you must use it, consider forking the repository and pinning the dependency to a specific commit SHA that you have verified as safe.
Conclusion
The @chatunity/baileys package has a critical vulnerability due to its reliance on an unverified git source for a key dependency. Users are advised to update to the latest version or implement workarounds to mitigate risks associated with this issue. Regular monitoring for vulnerabilities using tools like Vulert is recommended.
See every vulnerability recorded for @chatunity/baileys →
FAQ
The vulnerability allows for the execution of potentially malicious code due to the mutable nature of its dependency on libsignal from an off-registry source.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The risks include unauthorized access to your application, data manipulation, and potential compromise of user data due to the execution of malicious code.
Yes, updating to the latest version of @chatunity/baileys will provide a patch for this vulnerability.
If immediate updates are not possible, consider forking the repository and pinning the dependency to a known safe commit as a temporary measure.
