Malicious Code Injection in @xayz/baileys: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17384: Malicious code in @xayz/baileys (npm). Affects @xayz/baileys versions 3.0.0 – 6.1.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @xayz/baileys package is a widely used library for interacting with the WhatsApp Web API. It allows developers to build applications that can send and receive messages, manage contacts, and utilize various WhatsApp features. However, this package has been identified as part of a family of malicious forks that compromise user accounts by injecting covert actions into the WhatsApp socket layer.
Vulnerability Detail
The vulnerability arises from malicious code embedded in specific versions of the @xayz/baileys package. This code executes an unauthorized FOLLOW query to subscribe the victim's WhatsApp account to attacker-controlled channels without their consent. The malicious action is executed using the installer's own authenticated WhatsApp session, allowing attackers to gain subscribers for their channels. The obfuscation techniques used to hide the target JIDs make it difficult for users to detect the malicious behavior during code review.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @xayz/baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the @xayz/baileys package from your project until a secure version is confirmed. You can do this by running: npm uninstall @xayz/baileys. Additionally, monitor your application for any unauthorized subscriptions or activities.
Conclusion
The @xayz/baileys package has been compromised by malicious code that allows attackers to subscribe users to unwanted channels. It is crucial for developers using this package to update to a secure version and monitor their applications for any unauthorized activities. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for @xayz/baileys →
FAQ
The affected versions include 6.1.8, 6.1.7, 6.1.6, 6.1.5, 6.1.4, 6.1.3, 6.1.2, 6.1.1, 6.1.0, 6.0.75, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.0.0, 4.0.0, and 3.0.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert provides real-time alerts. You can also check your application using the Vulert playground at Vulert Scanner without any signup.
If immediate updates are not possible, consider removing the package temporarily and monitoring your application for any suspicious activities or unauthorized subscriptions.
No, the malicious action does not exfiltrate credentials or execute arbitrary remote code. It solely subscribes the victim's account to channels without their consent.
The vulnerability was identified by OX Security, who reported the malicious behavior associated with the @xayz/baileys package.
