npm package report

Is @whiskeysockets/baileys safe?

1 known vulnerability, worst severity CRITICAL.

// reach

0 direct dependencies

none carry a known advisory

    0 packages depend on it

    an advisory here reaches each of them

      Create a free accountfor every dependency path, dependent and what to upgrade
      // ai model usage

      Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

      cvss
      0.0
      critical

      severity out of 10

      epss
      0.00%
      low

      chance of exploitation in 30 days, 11th percentile of all CVEs

      xyz score
      not scored

      CyberXYZ composite out of 10

      fig. 01 — GHSA-qvv5-jq5g-4cgg, the advisory selected below

      // 1 advisories

      GHSA-qvv5-jq5g-4cgg

      CRITICALCVE-2026-48063
      // impact

      Any baileys session under the latest version (< 7.0.0-rc12, and < 6.7.22) can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync.

      // patches

      https://github.com/WhiskeySockets/Baileys/commit/3beb08eecfcb4e65722e674034bd84fb11a9de35 This commit has patched the issue, and a version tag has been released under 7.0.0 (6.7.22) for those still on Baileys v6. A new Baileys version, v7.0.0-rc12, has been released to remediate this.

      // workarounds

      There are no real workarounds other than dropping messages.upsert events that contain a requestId field, turning off automatic history sync (shouldSyncHistoryMessage: () => false) in socket config. There are no workarounds for the app state sync jamming.

      // cvss v4.0 vector

      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

      Attack vector
      Network
      Attack complexity
      Low
      Attack requirements
      None
      Privileges required
      None
      User interaction
      None
      Confidentiality (vulnerable system)
      High
      Integrity (vulnerable system)
      High
      Availability (vulnerable system)
      None
      Confidentiality (subsequent systems)
      None
      Integrity (subsequent systems)
      None
      Availability (subsequent systems)
      None

      Checked 2026-09-26 at 01:05 UTC. The most recent advisory here was published 2026-06-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.

      Think a verdict here is wrong? Tell us — we respond within 2 business days.