@xayz/baileys@6.1.9
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-17384
Ecosystem
npm
Summary
On the first successful WhatsApp connection via makeWASocket, the library issues a FOLLOW query for a hardcoded author-controlled newsletter JID (120363427430697245@newsletter) using the end user's authenticated WhatsApp session. The behavior is driven by a DEFAULT_AUTO_FOLLOW_CHANNELS constant consumed by the connection 'open' handler, which calls newsletterWMexQuery(jid, QueryIds.FOLLOW) for each entry. The behavior is documented and can be disabled via autoFollowChannels:false, but the default-on configuration uses the installer-user's WhatsApp identity to inflate the author's channel reach on a third-party platform. No credential theft, no exfiltration of installer secrets, no remote code execution, no persistence, and no install- or import-time destructive action; the ping-related static match in lib/Utils/generics.js corresponds to a WebSocket keepalive/latency utility, not network exfiltration.
Source: amazon-inspector (3970c07a60e90f00f876e1f17c68e2eac1de32b845c00599ccf54b522b2d7245)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.