Malicious Code Injection in rubbydev-crash-baileys: Unauthorized WhatsApp Channel Subscription
Summary
MAL-2026-17450: Malicious code in rubbydev-crash-baileys (npm). Affects rubbydev-crash-baileys versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rubbydev-crash-baileys is a fork of the Baileys WhatsApp Web library designed for developers to interact with WhatsApp's web interface. This package allows users to create applications that can send and receive messages, manage contacts, and utilize WhatsApp's features programmatically. However, a recent vulnerability has been identified that allows the package publisher to exploit users' authenticated WhatsApp sessions without their consent.
Vulnerability Detail
The vulnerability originates from the publisher injecting malicious code into the rubbydev-crash-baileys package. This code utilizes the installer's authenticated WhatsApp session to subscribe the user's account to selected WhatsApp Channels (newsletters) without their knowledge. Specifically, the code sends a FOLLOW query for a predetermined channel JID, effectively inflating the publisher's subscriber count. The malicious behavior is triggered whenever a socket is created, with no opt-out option provided to the user. The injected code resides in the file package/lib/Socket/newsletter.js, specifically between lines 62-70, and is executed shortly after the socket creation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rubbydev-crash-baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the rubbydev-crash-baileys package until a patched version is released. Additionally, you may consider using alternative libraries for WhatsApp integration that do not exhibit this vulnerability.
Conclusion
The rubbydev-crash-baileys package has a significant vulnerability that allows unauthorized subscription to WhatsApp Channels using users' authenticated sessions. It is crucial to update the package or find alternatives to mitigate this risk. Users should remain vigilant and utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for rubbydev-crash-baileys →
FAQ
rubbydev-crash-baileys is a library that allows developers to interact with WhatsApp's web interface programmatically.
The vulnerability allows the package publisher to use users' WhatsApp accounts to subscribe them to channels without their consent, potentially leading to unwanted notifications and privacy concerns.
No, the malicious code does not provide an opt-out option for users, making it imperative to remove or update the package.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can alert you in real-time about any vulnerabilities, including this one.
If an immediate update is not possible, consider using alternative libraries for WhatsApp integration and monitor for updates on the rubbydev-crash-baileys package.
