Malicious Code Injection in eliteprotech-baileys Package
Summary
MAL-2026-17391: Malicious code in eliteprotech-baileys (npm). Affects eliteprotech-baileys versions 1.1.0 – 1.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The eliteprotech-baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp API. It is part of a larger family of similar packages that have been identified as potentially harmful. This package allows developers to integrate WhatsApp functionalities into their applications, but it has been compromised to include malicious code that exploits user accounts.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the eliteprotech-baileys package. This code injects a covert channel-subscription action into the WhatsApp socket layer, allowing attackers to silently subscribe the victim's account to channels without their consent. The attack utilizes the installer's own authenticated WhatsApp session to issue a FOLLOW query to attacker-controlled channels. The target JIDs are obfuscated using various techniques, making it difficult for users to detect the malicious behavior. This vulnerability does not exfiltrate credentials or execute arbitrary remote code, but it does misuse the user's authenticated session for unauthorized actions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall eliteprotech-baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the eliteprotech-baileys package until a secure version is confirmed. Additionally, consider using alternative libraries that do not exhibit this vulnerability.
Conclusion
The eliteprotech-baileys package contains a serious vulnerability that allows unauthorized channel subscriptions through the misuse of authenticated WhatsApp sessions. Users are advised to update or remove the package to mitigate risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for eliteprotech-baileys →
FAQ
The eliteprotech-baileys package is a library that allows developers to interact with the WhatsApp API, enabling functionalities such as sending messages and managing contacts.
The vulnerability allows attackers to subscribe your WhatsApp account to channels without your consent, potentially exposing you to unwanted content and communications.
You should immediately update the package to the latest version or remove it from your project until a secure version is available.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The malicious code employs various obfuscation techniques, including plain string literals, base64 encoding, and dynamic reconstruction of character arrays to hide the target JIDs from casual review.
