Malicious NPM Packages Exploit Baileys Forks for WhatsApp Abuse

• •82 malicious Baileys packages identified, affecting WhatsApp accounts.
• •Attackers exploit trust in NPM forks for non-consensual actions.
• •Runtime analysis is crucial for detecting this type of supply chain abuse.

A campaign involving malicious forks of the Baileys NPM package exploits WhatsApp accounts by forcing them to follow attacker-controlled channels and injecting advertising URLs into sent media. The campaign has identified 82 confirmed malicious packages built on Baileys across 375 versions, alongside 15 impersonators of the libsignal-node library. Attackers utilize silent follow mechanisms and non-consensual messaging to manipulate user accounts without credential theft. Continuous monitoring has revealed over 4,250 package names associated with Baileys, with the malicious campaign still expanding. Detection methods emphasize the need for runtime-aware supply chain controls, as the malicious behavior executes post-installation, hidden within legitimate code. Current defenses must focus on behavior-aware analysis rather than solely relying on install-time scanning. The situation remains dynamic, with further investigations ongoing.