Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

Malware in sauruslord-baileys

The npm package sauruslord-baileys contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system with the package installed or running
Ecosystems
Attack vectors
Affected entities
  • sauruslord-baileys

The npm package sauruslord-baileys has been identified as containing malware. According to the GitHub Advisory (GHSA-h2r9-2p5m-9f8g), any computer that has this package installed or running should be considered fully compromised.\n\nThe advisory indicates that all secrets and keys stored on affected computers should be rotated immediately from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise, given that the attacker may have gained full control of the system.\n\nThis is a critical supply chain attack affecting the npm ecosystem through a malicious package distribution.

Indicators of compromise

Packages
  • sauruslord-baileys

Remediation

  • Immediately isolate any computer that has sauruslord-baileys installed or running from the network
  • Rotate all secrets, keys, and credentials from a different, uncompromised computer
  • Remove the sauruslord-baileys package from affected systems
  • Perform a full security audit and malware scan of affected systems
  • Review system logs for any unauthorized access or activity
  • Consider full system reimaging if compromise is confirmed

Sources

  1. GitHub Advisory GHSA-h2r9-2p5m-9f8g · GitHub Advisory Database

Cite this entry

"Malware in sauruslord-baileys." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 15, 2026; last updated July 15, 2026. https://supplychainattack.org/incident/malware-in-sauruslord-baileys-1540xr

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    ​ ​AsyncAPI npm packages infected with credential-stealing malware

    Five malicious versions of AsyncAPI npm packages were published in a supply-chain attack delivering a remote access trojan with credential-stealing capabilities. The attack compromised the npm package registry with info-stealing malware.

    npmCompromised package
  2. resolvedcritical

    Malicious code in rhynpm (npm)

    The npm package rhynpm was found to contain malicious code. The package was identified by the OpenSSF malicious packages project and reported via GitHub Security Advisory GHSA-5jr8-4283-75xm.

    npmCompromised package
  3. resolvedcritical

    Malicious code in angylarjs (npm)

    Malicious code was discovered in the angylarjs npm package. The package was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-qqc2-6x9j-cm25.

    npmCompromised package
  4. containedcritical

    Malware in @hkyyy/portal-widget-helper-0601

    Malware was discovered in the npm package @hkyyy/portal-widget-helper-0601. Systems with this package installed are considered fully compromised and require immediate remediation.

    npmCompromised package