Malicious code in @dreamguyxeon/baileyx (npm)
@dreamguyxeon/baileyx, a Baileys WhatsApp Web API fork on npm, contains malicious code that silently auto-follows newsletters from a remote-controlled list after session setup. The package also patches the libsignal dependency to use a compromised version from @dgxeon13/libsignal-node.
- Disclosed
- Last updated
- Blast radius
- All users of @dreamguyxeon/baileyx npm package versions containing the malicious code
- Ecosystems
- Attack vectors
- Affected entities
- @dreamguyxeon/baileyx · 5.0.0
@dreamguyxeon/baileyx is a fork of the Baileys WhatsApp Web API library published on npm. The package contains undisclosed malicious functionality in lib/Socket/newsletter.js that activates at runtime when makeNewsletterSocket is called, not during installation.
The malicious behavior includes: after a 120-second delay following session setup, the code fetches a remote JSON configuration from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json and silently auto-follows newsletter JIDs listed in that file without user consent. Additionally, the package fetches Baileys version metadata from DGXeon13/dgxeon-soket and replaces the libsignal dependency with a patched version from npm:@dgxeon13/libsignal-node@1.0.0, which itself modifies @whiskeysockets/baileys.
This malicious activity has been independently corroborated by LPM Firewall's public malicious report for version 2.0.0. Related malicious packages include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806), indicating a pattern of compromised packages from the same source.
Indicators of compromise
- Packages
- @dreamguyxeon/baileyx
- @dgxeon13/libsignal-node
- Domains
- raw.githubusercontent.com/DGXeon13/strings
- Hashes
- 0dffc5f0c8fd53b520c26de8788e6eafb1d939070a698e39f9f9853f42e6f7db
Remediation
- Remove @dreamguyxeon/baileyx from all projects and dependencies
- Audit package.json and lock files for any presence of @dreamguyxeon/baileyx or related DGXeon packages
- Replace with the legitimate @whiskeysockets/baileys package if WhatsApp Web API functionality is needed
- Review any newsletters followed during the use of this package and unfollow if necessary
- Check for and remove any instances of @dgxeon13/libsignal-node and replace with the legitimate @whiskeysockets/libsignal
- Monitor npm registry for similar malicious packages from DGXeon sources
Sources
- GitHub Advisory GHSA-8x56-j9vw-j3gq · GitHub Advisory Database
Cite this entry
"Malicious code in @dreamguyxeon/baileyx (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-dreamguyxeon-baileyx-npm-yalucr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit