Malicious Code Injection in my-baileys: Unauthorized WhatsApp Channel Subscription
Summary
MAL-2026-17400: Malicious code in my-baileys (npm). Affects my-baileys versions 1.0.1 – 1.0.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
my-baileys is an npm package that serves as a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp Web API. It allows developers to build applications that can send and receive messages, manage contacts, and perform various actions on WhatsApp. However, certain versions of this package have been compromised, leading to a significant security vulnerability that exploits users' authenticated sessions.
Vulnerability Detail
The vulnerability in my-baileys arises from the injection of malicious code that activates upon connection to the WhatsApp socket layer. This code executes an unauthorized 'w:mex' FOLLOW query, subscribing the victim's account to attacker-controlled WhatsApp channels without their consent. The obfuscation techniques used to conceal the target JIDs make it difficult for users to detect this malicious behavior. While the attack does not exfiltrate credentials or execute arbitrary code, it leverages the user's authenticated session to gain unauthorized access to their WhatsApp account.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall my-baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the my-baileys package from your project until a secure version is available. You can do this by executing: npm uninstall my-baileys. Additionally, monitor your WhatsApp account for any unauthorized subscriptions and remove them promptly.
Conclusion
The my-baileys package has been compromised, allowing attackers to exploit users' authenticated WhatsApp sessions to subscribe them to unwanted channels. It is crucial to update to a secure version to protect against this vulnerability. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for my-baileys →
FAQ
my-baileys is an npm package that allows developers to interact with the WhatsApp Web API, enabling functionalities like sending messages and managing contacts.
The vulnerability allows attackers to subscribe your WhatsApp account to channels without your consent, potentially leading to unwanted notifications and privacy concerns.
Versions 1.0.1 to 1.0.5 of the my-baileys package are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one. Visit Vulert Scanner to check your application without signup.
If you cannot update the my-baileys package right away, consider uninstalling it and monitoring your WhatsApp account for any unauthorized subscriptions.
