zeroz-baileys@1.0.1
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-17933
Ecosystem
npm
Summary
zeroz-baileys@1.0.1 appears to be a fork of the Baileys WhatsApp library. A static pattern matched on keyword co-occurrence in lib/Utils/messages-media.js (require('child_process'), https.request, hostname, POST) within a single file. This shape is expected for a media-handling utility in a WhatsApp library (media upload/download via HTTPS requests, optional native tool dispatch). Traced-code corroboration of installer-side harm was not established — no specific installer secret is named as read, and no non-first-party attacker-controlled destination is identified. Being a fork of a widely-used library, the package warrants human review to confirm whether the fork introduces covert behavior (e.g., using the installer's WhatsApp session for author-controlled actions) versus being a legitimate derivative.
Source: amazon-inspector (7be2199641fd598bfa6c6a11fac2567fa0c50f3f55ae3a8e8cd9ecd6ec4bf20f)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.