Covert Channel Subscription Vulnerability in @teamolduser/baileys Package
Summary
MAL-2026-17380: Malicious code in @teamolduser/baileys (npm). Affects @teamolduser/baileys versions 9.10.1 – 9.7.3-beta.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @teamolduser/baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp platform. It allows developers to create applications that can send and receive messages, manage contacts, and perform various other tasks on WhatsApp. However, this package has been identified as part of a larger family of malicious forks that introduce vulnerabilities, specifically by injecting covert actions into the WhatsApp socket layer.
Vulnerability Detail
The vulnerability arises from malicious code embedded within the @teamolduser/baileys package, which is part of a family of over 100 similar forks. This code executes an unauthorized FOLLOW query using the installer's authenticated WhatsApp session, subscribing the victim's account to attacker-controlled channels without consent. The target JIDs are obfuscated using various techniques, making it difficult for users to detect the malicious behavior. This vulnerability does not exfiltrate credentials or execute arbitrary code but exploits the user's session for unauthorized channel subscriptions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @teamolduser/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the @teamolduser/baileys package until a secure version is confirmed. Additionally, consider using alternative libraries that do not exhibit this vulnerability.
Conclusion
The @teamolduser/baileys package has a significant vulnerability that allows unauthorized subscriptions to WhatsApp channels using the user's authenticated session. It is crucial for developers to update to a secure version and consider alternative libraries to mitigate risks.
See every vulnerability recorded for @teamolduser/baileys →
FAQ
The vulnerability allows malicious code to subscribe users to unauthorized WhatsApp channels using their authenticated session.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should update the package to the latest secure version using npm install @teamolduser/baileys@latest.
No, this vulnerability does not exfiltrate credentials but exploits the user's session for unauthorized actions.
Yes, consider using other WhatsApp libraries that do not have known vulnerabilities.
