npm package report

Is @rixxcodex/baileys safe?

Versions 8.2.0, 8.0.16, 8.1.0, 8.0.15 and 9.0.3 of @rixxcodex/baileys were compromised. Other versions are not flagged as malicious. npm's latest tag points to 9.0.3, one of these versions, so an unpinned install gets it.

Do not install the 5 versions listed below

CRITICAL

Compromised releases. Added to CyberXYZ 2026-09-23, OSV malicious-package feed (Google / OpenSSF).

// what we observed

file identical to known malware+70
lib/Utils/messages-media.js is byte-identical to known malware (sha256 657662b2ae2e8cc1808715d8219d4e7ca7182f6eacda8d79b1cee4b721c88939 = osv:MAL-2026-16483(@rixxcodex/baileys))
follows WhatsApp channels through your account+70
follows WhatsApp channels through the user's session, unasked in lib/Socket/socket.js
package contents+8
source finding (sev 10)

Reported by Amazon Inspector via OSV.

// versions and what to do

Malicious: 8.2.0, 8.0.16, 8.1.0, 8.0.15, 9.0.3
Move to: 9.0.1 newest 9.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @rixxcodex/baileys@9.0.1

OSV record reference reference reference reference

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-30 at 19:38 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.