npm package report

Is @jexkcode/baileys safe?

Versions 1.3.0, 1.1.4, 1.2.0 and 1.1.5 of @jexkcode/baileys were flagged as malicious by CyberXYZ cross-signal detection (automatic), not yet confirmed. Other versions are not flagged. npm's latest tag points to 1.3.0, one of these versions, so an unpinned install gets it.

Do not install @jexkcode/baileys 1.3.0, 1.1.4, 1.2.0 or 1.1.5

HIGH

Multi-signal supply-chain anomaly (cross-signal auto). Added to CyberXYZ 2026-10-26, CyberXYZ cross-signal detection, automatic.

// what we observed

follows WhatsApp channels through your account+70
follows WhatsApp channels through the user's session, unasked in lib/Utils/auto-follow.js
package contents+8
source finding (sev 10)
package contents+20
install_hook finding (sev 8, not novel)

// versions and what to do

Malicious: 1.3.0, 1.1.4, 1.2.0, 1.1.5
Move to: Pin a release that is not listed above: the latest tag points to one that is.

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-30 at 19:37 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.