{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/Socket/chats.js",
              "sha256": "06dca1b96cbc00d05c321eb5a5a1647ad5a79c9c9f04e119d1319237c7caf049",
              "tlsh": "6d4464d04fd1a01361ce96afbf156ea8732bd352ea84b14761d77ac824eda43c360de1"
            },
            {
              "path": "package.json",
              "sha256": "b3348d098797d2eac851786dd728164056ac5e9ccf869c289023b342fb11c2d8",
              "tlsh": "d9c11037ce88ce6306b173d9a5b50242f4580b4f1a90cc4f717d5bac8fb39072195b69"
            }
          ],
          "package_integrity": [
            {
              "filename": "baileys-2.2.7.tgz",
              "hashes": {
                "sha1": "6b1725bcc55dc1b831e3655803c37726c2599497",
                "sha512_sri": "sha512-awsZivZPtxV82WwuKFEY6VMLnDoISVChsaW4xQNyEKokWOi0deeIB4I3f199xHPUiDwDhTKj6pvfG/hC3655Ew=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@nexustechpro/baileys"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "2.2.7"
      ]
    }
  ],
  "aliases": [
    "GHSA-8w6v-4xp9-rvrr"
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-019904",
        "import_time": "2026-09-09T22:38:09.680342884Z",
        "modified_time": "2026-09-09T22:27:09Z",
        "sha256": "fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab",
        "source": "amazon-inspector",
        "versions": [
          "2.2.7"
        ]
      },
      {
        "id": "GHSA-8w6v-4xp9-rvrr",
        "import_time": "2026-10-12T16:30:26.940867369Z",
        "modified_time": "2026-10-12T15:32:23Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "540ddb6572705d776d96d9199b385b55b45093ea3f9da298751ae13c289d924d",
        "source": "ghsa-malware"
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab)\n@nexustechpro/baileys is a fork of the WhatsApp library `baileys` in which lib/Socket/chats.js (~270 KB) is heavily obfuscated (obfuscator.io-style rotating string-array decoder, hex-escaped import specifiers such as \u0027\\x40\\x63\\x61\\x63\\x68\\x65\\x61\\x62\\x6c\\x65\\x2f\\x6e\\x6f\\x64\\x65\\x2d\\x63\\x61\\x63\\x68\\x65\u0027, integer-arithmetic control flow, unicode identifier names, ~2772-entry string array) while every sibling file in lib/Socket/ (groups.js, messages-recv.js, socket.js, registration.js) remains readable JavaScript and the upstream whiskeysockets/baileys ships this file unobfuscated. The obfuscated module is reachable from the package entry point (lib/index.js) and sits directly in the code path that handles WhatsApp session state (authState credentials, Signal identity keys, noise keys, signed pre-keys). package.json additionally declares `\"whatsapp-rust-bridge\": \"latest\"`, a floating unpinned tag on a non-upstream dependency, which allows that dependency\u0027s publisher to ship arbitrary code (including install lifecycle scripts) into every installer of this package on any future install with no version pin or integrity check.\n\n## Source: ghsa-malware (540ddb6572705d776d96d9199b385b55b45093ea3f9da298751ae13c289d924d)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n",
  "id": "MAL-2026-16104",
  "modified": "2026-10-12T16:32:21.501160462Z",
  "published": "2026-09-09T22:27:09Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@nexustechpro/baileys/v/2.2.7"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8w6v-4xp9-rvrr"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @nexustechpro/baileys (npm)"
}