Malware in sauruslord-baileys
The npm package sauruslord-baileys contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- sauruslord-baileys
The npm package sauruslord-baileys has been identified as containing malware. According to the GitHub Advisory (GHSA-h2r9-2p5m-9f8g), any computer that has this package installed or running should be considered fully compromised.\n\nThe advisory indicates that all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise, given that the attacker may have gained full control of the system.\n\nThis is a critical supply chain attack affecting the npm ecosystem through a malicious package distribution.
Indicators of compromise
- Packages
- sauruslord-baileys
Remediation
- Immediately isolate any computer that has sauruslord-baileys installed or running from the network
- Rotate all secrets, keys, and credentials from a different, uncompromised computer
- Remove the sauruslord-baileys package from affected systems
- Perform a full security audit and malware scan of affected systems
- Review system logs for any unauthorized access or activity
- Consider full system reimaging if compromise is confirmed
Sources
- GitHub Advisory GHSA-h2r9-2p5m-9f8g · GitHub Advisory Database
Cite this entry
"Malware in sauruslord-baileys." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 15, 2026; last updated July 15, 2026. https://supplychainattack.org/incident/malware-in-sauruslord-baileys-1540xr
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
AsyncAPI npm packages infected with credential-stealing malware
Five malicious versions of AsyncAPI npm packages were published in a supply-chain attack delivering a remote access trojan with credential-stealing capabilities. The attack compromised the npm package registry with info-stealing malware.
npmCompromised package - resolvedcritical
Malicious code in rhynpm (npm)
The npm package rhynpm was found to contain malicious code. The package was identified by the OpenSSF malicious packages project and reported via GitHub Security Advisory GHSA-5jr8-4283-75xm.
npmCompromised package - resolvedcritical
Malicious code in angylarjs (npm)
Malicious code was discovered in the angylarjs npm package. The package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-qqc2-6x9j-cm25.
npmCompromised package - containedcritical
Malware in @hkyyy/portal-widget-helper-0601
Malware was discovered in the npm package @hkyyy/portal-widget-helper-0601. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package