Malicious code in @ndikagantengg/baileys (npm)
MAL-2026-19152
Published · Modified
Dependency scanning
Check whether @ndikagantengg/baileys is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
Malicious package. @ndikagantengg/baileys is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363428626908481@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes