Malicious Code Injection in danz-bails: Exploiting WhatsApp Sessions
Summary
MAL-2026-17444: Malicious code in danz-bails (npm). Affects danz-bails versions 1.0.0 – 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The danz-bails package is a fork of the Baileys WhatsApp Web library, primarily used for interacting with WhatsApp's web interface programmatically. It allows developers to build applications that can send and receive messages, manage contacts, and utilize WhatsApp's features. However, this package has been compromised, leading to unauthorized actions being performed on behalf of users without their consent.
Vulnerability Detail
The vulnerability stems from malicious code injected by the publisher of the danz-bails package. This code exploits the installer's authenticated WhatsApp session to subscribe the user's account to selected WhatsApp Channels without their knowledge. The code sends FOLLOW queries for specific channel JIDs at regular intervals whenever a WhatsApp socket is created. This covert action inflates the publisher's channel subscribers, compromising user privacy and trust.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall danz-bailsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the danz-bails package until a fix is released. Additionally, consider monitoring your WhatsApp account for any unauthorized subscriptions and remove them manually if necessary.
Conclusion
The danz-bails package has a serious vulnerability that allows unauthorized actions on users' WhatsApp accounts. It is crucial for developers to update or remove this package to protect user privacy and maintain trust. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for danz-bails →
FAQ
danz-bails is a fork of the Baileys WhatsApp Web library that allows developers to interact with WhatsApp's web interface.
The vulnerability allows the publisher to use the user's WhatsApp account to subscribe to channels without their consent, compromising user privacy.
Users should avoid using the danz-bails package until a patched version is released and monitor their WhatsApp accounts for unauthorized activity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed the danz-bails package, update it to the latest version or remove it from your project until a fix is available.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
