npm package report

Is @zeppeliorg/xzcbailz safe?

Version 1.0.2 of @zeppeliorg/xzcbailz was flagged as malicious by CyberXYZ cross-signal detection (automatic), not yet confirmed. Other versions are not flagged. npm's latest tag points to 1.0.2, one of these versions, so an unpinned install gets it.

Do not install @zeppeliorg/xzcbailz 1.0.2

CRITICAL

Tarball ships a file byte-identical to known malware (cross-signal auto). Added to CyberXYZ 2026-10-26, CyberXYZ cross-signal detection, automatic.

// what we observed

file identical to known malware+70
lib/Socket/messages-recv.js is byte-identical to known malware (sha256 c5fa28e430dd174ed8f42515130db2651edfa5b7c7e6a8f01bef7d6a62d2c1d7 = confirmed_scan:@itsmee_aizat.id/baileys2@2.0.0(@itsmee_aizat.id/baileys2), confirmed_s)
follows WhatsApp channels through your account+70
follows WhatsApp channels through the user's session, unasked in lib/Socket/newsletter.js
package contents+8
source finding (sev 10)

// versions and what to do

Malicious: 1.0.2
Move to: 1.0.1 newest 1.x release, no known advisory

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install @zeppeliorg/xzcbailz@1.0.1

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-30 at 19:43 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.