Critical Malicious Code Vulnerability in sea-baileys Package
Summary
MAL-2026-16473: Malicious code in sea-baileys (npm). Affects sea-baileys versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sea-baileys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with the WhatsApp Web API. It offers features for sending messages, handling media, and managing user sessions. However, due to its reliance on external dependencies, it has become vulnerable to malicious code injection, posing significant risks to user data and privacy.
Vulnerability Detail
The vulnerability arises from the sea-baileys package remapping the 'libsignal' import to 'npm:@otaxayun/libsignal-node@latest', which is an external package controlled by an unrelated maintainer. This mutable dependency can be replaced at any time, allowing malicious code to compromise the user's WhatsApp cryptographic identity and message stream. Additionally, the package modifies outgoing media messages by attaching unsolicited promotional content, further violating user trust.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sea-baileysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the sea-baileys package until a secure version is released. Alternatively, consider using a different library that does not have this vulnerability.
Conclusion
The sea-baileys package contains a critical vulnerability that exposes users to potential malicious code and unauthorized modifications of their WhatsApp messages. It is crucial to update the package to a secure version or consider alternative solutions to protect user data.
See every vulnerability recorded for sea-baileys →
FAQ
Sea-baileys is a fork of the Baileys WhatsApp Web library that allows developers to interact with the WhatsApp Web API.
The malicious code can compromise users' WhatsApp cryptographic identities and modify outgoing messages to include unsolicited promotional content.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring access to the code.
Check for updates to the sea-baileys package. If a patched version is available, you can update it using 'npm install sea-baileys@latest'.
As a workaround, consider avoiding the use of the sea-baileys package until a secure version is released or switch to an alternative library.
