npm package report

Is @alannxds/baileys safe?

Version 6.2.10 of @alannxds/baileys was compromised (WhatsApp channel hijack (PhantomSub): follows publisher-chosen channels through the user's session). Other versions are not flagged as malicious.

Do not install @alannxds/baileys 6.2.10

CRITICALanalyst verified

WhatsApp channel hijack (PhantomSub): follows publisher-chosen channels through the user's session. Added to CyberXYZ 2026-10-24, verified by a CyberXYZ analyst.

// what we observed

file identical to known malware+70
lib/Utils/browser-utils.js is byte-identical to known malware (sha256 d26648f3f4042e589a8ece747f847bc09c9c0a8fff38c0fe81ad62389b77be95 = confirmed_scan:prastzy@2.0.0(prastzy))
package contents+15
novel source finding (sev 10)
install script diff+20
preinstall appeared vs prior version (no network/exec in the script itself — corroborating only)

// versions and what to do

Malicious: 6.2.10
Move to: 6.2.11 newest 6.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @alannxds/baileys@6.2.11

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-30 at 19:41 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.