Malicious code in @prototypevip/baileys (npm)
@prototypevip/baileys, a fork of the Baileys WhatsApp library on npm, contained malicious code that hijacked incoming WhatsApp messages and sent attacker-authored Arabic messages through the installer's authenticated WhatsApp account. The malicious code was obfuscated using base64 encoding and targeted users whose bot was not tagged with a hardcoded owner string.
- Disclosed
- Last updated
- Blast radius
- All users of @prototypevip/baileys who installed the malicious version
- Ecosystems
- Attack vectors
- Affected entities
- @prototypevip/baileys
@prototypevip/baileys is a fork of the Baileys WhatsApp library distributed on npm. The package contained malicious code embedded in lib/Store/prototype-store.js that registered a listener on the 'messages.upsert' event to intercept every incoming message.
The malicious payload was obfuscated using base64 string encoding and a decoder function (Buffer.from(s,'base64').toString('utf8')). When decoded, the strings resolved to property names ('type', 'md', 'ws', 'sendMessage'), an Arabic message body ('you are no longer authorized to use this bot'), and a marker string ('gintoki').
The code walked the message object to locate the active WhatsApp socket (identified by type=='md' with a truthy ws property) and compared an adjacent key against the hardcoded 'gintoki' marker. If the installer's bot was not tagged with this owner string, the malicious code invoked the installer's own socket's sendMessage function to broadcast the Arabic message through the installer's WhatsApp account to their contacts, then threw a 'Blocked' exception to halt message handling.
This behavior was completely undocumented and abused the installer's authenticated WhatsApp session as a delivery channel for attacker-authored content. The incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @prototypevip/baileys
Remediation
- Immediately uninstall @prototypevip/baileys from all systems
- Audit npm package.json and lock files for any installations of @prototypevip/baileys
- Review WhatsApp message history for any unauthorized messages sent through compromised accounts
- Use the legitimate Baileys library (baileys) from a trusted source instead
- Implement package integrity verification and supply chain security scanning in your dependency management process
- Monitor npm for similar malicious forks of popular libraries
Sources
- GitHub Advisory GHSA-rj44-3fvq-rvp4 · GitHub Advisory Database
Cite this entry
"Malicious code in @prototypevip/baileys (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-prototypevip-baileys-npm-1jqci3
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package