Malicious Code Injection in @fhkryxv/baileys: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17352: Malicious code in @fhkryxv/baileys (npm). Affects @fhkryxv/baileys versions 1.0.1 – 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fhkryxv/baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp Web API. This package is part of a larger family of similar forks, which have been identified for their malicious behavior. The vulnerability arises from the package's ability to inject covert actions into the WhatsApp socket layer, allowing unauthorized subscriptions to channels.
Vulnerability Detail
The vulnerability in the @fhkryxv/baileys package stems from its malicious code that executes upon connection to the WhatsApp socket. This code issues an authenticated 'w:mex' FOLLOW query to subscribe the victim's account to attacker-controlled WhatsApp channels without their consent. The target JIDs are obfuscated using various techniques, making it difficult for users to detect the malicious behavior. The vulnerability does not exfiltrate credentials or execute arbitrary remote code, but it does misuse the user's authenticated session to gain unauthorized access to channels.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @fhkryxv/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @fhkryxv/baileys package until a secure version is confirmed. Additionally, consider using alternative libraries that do not exhibit this malicious behavior.
Conclusion
The @fhkryxv/baileys package has a significant vulnerability that allows malicious actors to subscribe users to unauthorized WhatsApp channels. It is crucial to update to a patched version and monitor your applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for @fhkryxv/baileys →
FAQ
The package contains malicious code that subscribes users to unauthorized WhatsApp channels without their consent.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Immediately update the package to the latest version using 'npm install @fhkryxv/baileys@latest' to mitigate the risk.
No, the vulnerability does not exfiltrate credentials; it only misuses your authenticated session to subscribe to channels.
Yes, consider using other libraries that provide similar functionality without the malicious behavior.
