@systemzero/baileys@1.1.2
Vulnerability report · Last retrieved from osv.dev September 7, 2026 at 4:03 PM UTC
OSV ID
MAL-2026-15820
Ecosystem
npm
Summary
This fork of Baileys wires an undocumented remote-control channel into makeWASocket, the package's main factory. On every socket construction it unconditionally opens a Server-Sent-Events connection to the hardcoded author endpoint https://zone.api.br/api/owner/whatsapp-signal-stream and keeps it alive with automatic reconnect/backoff. Incoming events named 'react' and 'follow' are executed against the installer's authenticated WhatsApp session by calling sock.newsletterReactMessage and sock.newsletterFollow with server-supplied newsletter JIDs, letting a remote author-controlled server cause the installer's account to follow channels and post reactions chosen by the operator of that server. Neither the endpoint nor the remote-controlled behavior is disclosed in the README or opt-in. A sibling helper hzxx.js hardcodes a specific newsletter JID (120363362355300503@newsletter, name 'shenvn.') and author contact metadata (telegram @blackhzx), consistent with a reach-padding operation driving installer identities toward author-selected channels.
Source: amazon-inspector (0d59f73139e4dffa0dab200eba9047ba3afc67ca92dcb897e052341a0f059362)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.