Malicious Code Injection in luoxy-baileys: Covert Subscription to WhatsApp Channels
Summary
MAL-2026-17446: Malicious code in luoxy-baileys (npm). Affects luoxy-baileys versions 7.1.1 – 7.1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
luoxy-baileys is a fork of the Baileys WhatsApp Web library designed for developers to interact with WhatsApp's web interface. It provides functionalities for sending messages, managing contacts, and subscribing to channels. However, this package has been compromised, allowing the publisher to manipulate users' WhatsApp accounts without consent, leading to unauthorized subscriptions to selected WhatsApp Channels.
Vulnerability Detail
The vulnerability arises from malicious code injected by the publisher, which automatically subscribes users to WhatsApp Channels upon establishing a connection. This is achieved through default settings in the library that enable auto-following of channels without user consent. The code fetches a list of channels from a remote source and sends follow requests using the user's authenticated session, thereby inflating the publisher's subscriber count. This covert operation poses a significant risk to user privacy and account integrity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall luoxy-baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can manually disable the auto-follow feature by modifying the library's configuration settings. Set 'autoFollowNewsletterOnConnect' to false in the Defaults index file:
const Defaults = {
autoFollowNewsletterOnConnect: false,
autoFollowNewsletterDelayMs: 90000,
autoFollowNewsletterJid: '120363400911374213@newsletter'
};
Conclusion
The luoxy-baileys package has been compromised with malicious code that automatically subscribes users to WhatsApp Channels without consent. It is crucial for users to update the package to the latest version and implement workarounds to mitigate risks. Regular monitoring and updates can help prevent such vulnerabilities in the future.
See every vulnerability recorded for luoxy-baileys →
FAQ
luoxy-baileys is a JavaScript library that allows developers to interact with WhatsApp's web interface for sending messages and managing contacts.
The vulnerability allows the publisher to use your WhatsApp account to subscribe to channels without your consent, potentially compromising your privacy.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you suspect that your account has been compromised, immediately update the package and review your WhatsApp subscriptions to remove any unauthorized channels.
To prevent similar vulnerabilities, regularly update your dependencies, review package code, and utilize tools like Vulert to monitor for open-source vulnerabilities.
