{"id":"MAL-2026-15820","url":"https://compromised.live/t/MAL-2026-15820","kind":"malicious_package","tier":3,"severity":"critical","title":"Malicious code in @systemzero/baileys (npm)","summary":"@systemzero/baileys (npm) is a malicious package. Anyone who installed it should treat that machine as compromised: remove the package and rotate any secrets it could reach.","summary_source":"template","affected":[{"ecosystem":"npm","package":"@systemzero/baileys","affected":"1.1.2","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T22:10:45.281Z","updated_at":"2026-11-04T09:52:46.694Z","status":"active","details":"@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller's authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","aliases":["GHSA-7fxw-7r63-529q","MAL-2026-15820"],"sources":[{"name":"ghsa","id":"GHSA-7fxw-7r63-529q","url":"https://github.com/advisories/GHSA-7fxw-7r63-529q"},{"name":"osv","id":"MAL-2026-15820","url":"https://osv.dev/vulnerability/MAL-2026-15820"}]}