Malicious Code Injection in kasabaileys Package: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17394: Malicious code in kasabaileys (npm). Affects kasabaileys versions 0.3.15 – 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kasabaileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with WhatsApp's web interface. It is part of a larger family of similar packages that have been identified as potentially malicious. These packages are known for their ability to manipulate WhatsApp sessions, which can lead to unauthorized actions being taken on behalf of the user. The specific vulnerability in kasabaileys allows attackers to silently subscribe users to channels without their consent, leveraging the user's authenticated session.
Vulnerability Detail
The kasabaileys package contains malicious code that injects a covert channel-subscription action into the WhatsApp socket layer. Upon connection, the injected code executes an authenticated 'w:mex' FOLLOW query against attacker-chosen WhatsApp Channel/Newsletter JIDs using the installer's own WhatsApp session. This results in the victim's account being subscribed to channels they did not intend to join. The malicious code employs various obfuscation techniques to hide the target JIDs from casual review, including string literals, base64 encoding, and dynamic fetching of target lists from remote sources. This vulnerability does not exfiltrate user credentials or execute arbitrary code, but it does misuse the user's authenticated session for malicious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kasabaileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the kasabaileys package from your project until a secure version is confirmed. You can do this by executing the following command: npm uninstall kasabaileys. Additionally, consider using alternative libraries that do not exhibit this vulnerability.
Conclusion
The kasabaileys package has a significant vulnerability that allows for unauthorized channel subscriptions through malicious code injection. Users are advised to update to the latest patched version and consider alternative libraries. Monitoring tools like Vulert can help keep your application secure by alerting you to vulnerabilities in real-time.
See every vulnerability recorded for kasabaileys →
FAQ
The kasabaileys package is a fork of the Baileys WhatsApp Web library, used for interacting with WhatsApp's web interface.
The vulnerability allows attackers to silently subscribe users to WhatsApp channels without their consent by exploiting the user's authenticated session.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized subscription to channels, which can lead to spam or unwanted content being delivered to the user's WhatsApp account.
Regularly update your dependencies, monitor for vulnerabilities using tools like Vulert, and review the source code of packages you use for any suspicious behavior.
