Malicious Code Injection in @revizahoshii/baileys: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17375: Malicious code in @revizahoshii/baileys (npm). Affects @revizahoshii/baileys versions 0.3.18 – 0.5.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @revizahoshii/baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp Web API. It allows developers to build applications that can send and receive messages, manage contacts, and perform various actions on WhatsApp. However, this package has been identified as part of a larger family of malicious forks that introduce vulnerabilities, specifically by injecting covert actions into the WhatsApp socket layer.
Vulnerability Detail
The vulnerability arises from malicious code embedded in specific versions of the @revizahoshii/baileys package. This code executes an unauthorized FOLLOW query against attacker-controlled WhatsApp channels using the installer's authenticated session. The malicious action subscribes the victim's account to channels without their consent, leveraging obfuscation techniques to hide the target JIDs from casual review. The vulnerability does not exfiltrate credentials or execute arbitrary remote code, but it does misuse the user's authenticated session to gain subscribers for malicious channels.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @revizahoshii/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the affected package from your project until a secure version is available. Use the following command to uninstall the package: npm uninstall @revizahoshii/baileys.
Conclusion
The @revizahoshii/baileys package has a significant vulnerability that allows malicious actors to subscribe users to unwanted WhatsApp channels using their authenticated sessions. It is crucial to update to a secure version or remove the package to mitigate risks. Tools like Vulert can assist in monitoring for such vulnerabilities in your applications.
See every vulnerability recorded for @revizahoshii/baileys →
FAQ
The vulnerability involves malicious code that subscribes users to unwanted WhatsApp channels using their authenticated session.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Affected versions include 0.5.4, 0.5.3, 0.5.2, 0.5.1, 0.5.0, 0.4.2, 0.4.1, 0.4.0, and 0.3.18.
No, the vulnerability does not exfiltrate credentials or execute arbitrary remote code; it only misuses the authenticated session.
If you cannot update the package, consider removing it from your project as a temporary measure until a secure version is available.
