Malicious Code Injection in @saazkira/baileys: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17377: Malicious code in @saazkira/baileys (npm). Affects @saazkira/baileys versions 2.1.6 – 2.1.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @saazkira/baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp Web API. It is part of a larger family of similar packages that have been identified as potentially malicious. These packages are known for their ability to manipulate WhatsApp sessions and perform unauthorized actions on behalf of the user.
Vulnerability Detail
The vulnerability arises from a malicious code injection that occurs when the package connects to the WhatsApp socket layer. This code executes an unauthorized 'w:mex' FOLLOW query using the user's authenticated session, subscribing the victim's account to attacker-controlled channels without consent. The targeted JIDs are obfuscated using various techniques, making detection difficult. This vulnerability does not exfiltrate user credentials or execute arbitrary code but exploits the user's session for malicious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @saazkira/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the @saazkira/baileys package until a secure version is confirmed. Additionally, consider using alternative libraries that do not exhibit these vulnerabilities.
Conclusion
The @saazkira/baileys package contains a significant vulnerability that allows malicious actors to exploit users' authenticated sessions for unauthorized actions. It is crucial for developers to update to the latest version and utilize tools like Vulert for ongoing monitoring to ensure the security of their applications.
See every vulnerability recorded for @saazkira/baileys →
FAQ
The vulnerability involves malicious code that subscribes users to unauthorized WhatsApp channels using their authenticated session.
You can use Vulert to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert can alert you in real-time about any open-source vulnerabilities.
The main consequence is unauthorized subscription to channels, which could lead to unwanted notifications and potential privacy concerns.
Yes, regularly update your dependencies and monitor them using tools like Vulert to catch vulnerabilities early.
Immediately update the package to the latest version using 'npm install @saazkira/baileys@latest' to mitigate the risk.
