{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/Socket/index.js",
              "sha256": "14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98",
              "tlsh": "be21eeab5efb7537092764ee0e0f4116bb301b037749ec4876aca348df950248691eca"
            },
            {
              "path": "lib/Utils/signal-stream.js",
              "sha256": "fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca",
              "tlsh": "1161014a56f321610993b0a90b4fd10aa33ee103794ecd487f5cab045f86168ead2fce"
            },
            {
              "path": "lib/Socket/hzxx.js",
              "sha256": "559ecfab41384f392c35bf07abb1dc797b967011773b6f8c3c2af212033454b8",
              "tlsh": "d482ff2a51b7292d4647b0793f9b74453134d01b4888bd29bf8c06ca9fcd68cbaf67d8"
            }
          ],
          "package_integrity": [
            {
              "filename": "baileys-1.1.2.tgz",
              "hashes": {
                "sha1": "ee05b2c035fe2288542368b63cdbee6bd6eecf04",
                "sha512_sri": "sha512-knCs2uz7SA43EP6ot50qDogBRoqezJq1fSYZUj0Y2hQMP0zz1NDibbgjj00P1oT6cLEM9EHGii3rfnneZzYTLw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@systemzero/baileys"
      },
      "versions": [
        "1.1.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://pkgwarden.com"
      ],
      "name": "pkgwarden",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "urls": [
        "https://zone.api.br/api/owner/whatsapp-signal-stream"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-019394",
        "import_time": "2026-09-04T00:45:55.480111482Z",
        "modified_time": "2026-09-03T23:51:37Z",
        "sha256": "0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362",
        "source": "amazon-inspector",
        "versions": [
          "1.1.2"
        ]
      }
    ]
  },
  "details": "@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library\u0027s socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller\u0027s authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362)\nThis fork of Baileys wires an undocumented remote-control channel into makeWASocket, the package\u0027s main factory. On every socket construction it unconditionally opens a Server-Sent-Events connection to the hardcoded author endpoint https://zone.api.br/api/owner/whatsapp-signal-stream and keeps it alive with automatic reconnect/backoff. Incoming events named \u0027react\u0027 and \u0027follow\u0027 are executed against the installer\u0027s authenticated WhatsApp session by calling sock.newsletterReactMessage and sock.newsletterFollow with server-supplied newsletter JIDs, letting a remote author-controlled server cause the installer\u0027s account to follow channels and post reactions chosen by the operator of that server. Neither the endpoint nor the remote-controlled behavior is disclosed in the README or opt-in. A sibling helper hzxx.js hardcodes a specific newsletter JID (120363362355300503@newsletter, name \u0027shenvn.\u0027) and author contact metadata (telegram @blackhzx), consistent with a reach-padding operation driving installer identities toward author-selected channels.\n",
  "id": "MAL-2026-15820",
  "modified": "2026-09-04T00:47:39.251325854Z",
  "published": "2026-09-01T00:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@systemzero/baileys"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-13929"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-13932"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@systemzero/baileys/v/1.1.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @systemzero/baileys (npm)"
}