Malicious Code Injection in ishumdz-bail Package: Covert WhatsApp Channel Subscription
Summary
MAL-2026-17393: Malicious code in ishumdz-bail (npm). Affects ishumdz-bail versions 1.0.1 – 1.0.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ishumdz-bail package is part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to facilitate interactions with WhatsApp's web interface. However, this package has been identified to contain malicious code that exploits the user's authenticated WhatsApp session, allowing attackers to silently subscribe users to unwanted channels.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the ishumdz-bail package. This code injects a covert channel-subscription action into the WhatsApp socket layer. Upon connecting, it executes an authenticated 'w:mex' FOLLOW query against attacker-chosen WhatsApp Channel/Newsletter JIDs using the user's own session. The targeted JIDs are obfuscated using various techniques, making them difficult to detect. This action does not exfiltrate user credentials or execute arbitrary code but does misuse the user's session to gain subscribers for malicious channels.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ishumdz-bailIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can remove the ishumdz-bail package from their project to prevent any malicious activity. This can be done using the command: npm uninstall ishumdz-bail. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The ishumdz-bail package contains a significant vulnerability that allows attackers to misuse users' authenticated WhatsApp sessions to subscribe them to unwanted channels. Users are advised to update to the latest version or remove the package to mitigate risks. Regular monitoring for vulnerabilities is crucial for maintaining application security.
See every vulnerability recorded for ishumdz-bail →
FAQ
The ishumdz-bail package is a fork of the Baileys WhatsApp Web library, designed to interact with WhatsApp's web interface.
The vulnerability allows attackers to subscribe your account to unwanted WhatsApp channels without your consent, using your authenticated session.
You may notice unexpected subscriptions to channels or newsletters on WhatsApp that you did not join.
No, the vulnerability does not exfiltrate credentials; it only misuses your authenticated session for malicious subscriptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground at Vulert Scanner.
