Malicious Code Injection in ichigo-baileys: Unauthorized WhatsApp Channel Subscriptions
Summary
MAL-2026-17445: Malicious code in ichigo-baileys (npm). Affects ichigo-baileys versions 1.0.0 – 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ichigo-baileys is a fork of the Baileys WhatsApp Web library designed for developers to interact with WhatsApp's web interface programmatically. It allows users to send messages, manage contacts, and perform various actions on WhatsApp. However, this package has been compromised by the publisher, who injected malicious code that exploits the user's authenticated WhatsApp session without their consent.
Vulnerability Detail
The vulnerability arises from the injection of malicious code into the ichigo-baileys package, which allows the publisher to use the installer's authenticated WhatsApp session to subscribe the account to selected WhatsApp Channels. This is done by sending a FOLLOW query for each target channel JID without the user's knowledge. The code obfuscates the method names and channel IDs, making it difficult for users to detect the malicious behavior. The potential ramifications include unauthorized use of the victim's WhatsApp account, leading to inflated subscriber counts for the publisher's channels.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ichigo-baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the ichigo-baileys package and look for alternative libraries that provide similar functionality without the risk of malicious code. Additionally, users can monitor their WhatsApp account for any unauthorized subscriptions and report them to WhatsApp.
Conclusion
The ichigo-baileys package has been compromised with malicious code that exploits users' WhatsApp sessions to subscribe them to channels without their consent. Users are advised to update or remove the package and monitor their accounts for unauthorized activity. Utilizing tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for ichigo-baileys →
FAQ
ichigo-baileys is a JavaScript library that allows developers to interact with WhatsApp's web interface programmatically.
The malicious code uses your authenticated WhatsApp session to subscribe your account to channels without your consent, potentially leading to unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed the ichigo-baileys package, it is recommended to update it to a patched version or remove it entirely until a secure version is available.
To prevent similar vulnerabilities, always review package dependencies, use trusted sources, and regularly monitor your applications for security updates.
