Malicious Code Injection in baileys-xbats: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17388: Malicious code in baileys-xbats (npm). Affects baileys-xbats versions 1.0.0 – 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The baileys-xbats package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp API. It is part of a larger family of similar packages that have been identified as potentially malicious. This package allows developers to build applications that can send and receive messages on WhatsApp, but the recent discovery of malicious code within certain versions raises serious security concerns.
Vulnerability Detail
The vulnerability in baileys-xbats arises from malicious code that injects a covert channel-subscription action into the WhatsApp socket layer. Upon connection, the injected code executes an authenticated 'w:mex' FOLLOW query against attacker-chosen WhatsApp Channel/Newsletter JIDs using the installer's own authenticated session. This silently subscribes the victim's account to channels without their consent. The obfuscation techniques used to hide the target JIDs make it difficult for users to detect this malicious behavior. The vulnerability does not exfiltrate credentials or execute arbitrary remote code but exploits the user's authenticated session for unauthorized channel subscriptions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall baileys-xbatsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the baileys-xbats package from your project until a secure version is confirmed. You can do this by running: npm uninstall baileys-xbats. Additionally, monitor your WhatsApp account for any unauthorized subscriptions.
Conclusion
The baileys-xbats package contains a significant vulnerability that allows malicious code to exploit users' authenticated WhatsApp sessions for unauthorized channel subscriptions. It is crucial for developers to update to the latest version or remove the package entirely to protect their accounts. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for baileys-xbats →
FAQ
Baileys-xbats is a fork of the Baileys WhatsApp Web library that allows developers to interact with the WhatsApp API.
The vulnerability allows malicious code to subscribe your WhatsApp account to channels without your consent, potentially leading to unwanted notifications and exposure to harmful content.
If you have installed an affected version of baileys-xbats, you should immediately update to the latest version or uninstall the package to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can help you identify if your application is affected. You can also use the Vulert playground without signup at Vulert Scanner.
To prevent similar vulnerabilities, always review package dependencies, keep them updated, and use tools like Vulert to monitor for vulnerabilities in your open-source packages.
