# MAL-2026-15820: Malicious code in @systemzero/baileys (npm)


- **Type:** Malicious package
- **Package:** `@systemzero/baileys` (npm)
- **Published:** 1 Sep 2026

## What is MAL-2026-15820?

MAL-2026-15820 is a malicious package in @systemzero/baileys, published on 1 Sep 2026. 

### Official description

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events it receives on the caller's authenticated WhatsApp session: a follow event resolves the supplied invite code and calls sock.newsletterFollow() (line 57), making the victim account follow an attacker-chosen channel, and a react event calls sock.newsletterReactMessage() with attacker-supplied serverId and emoji (line 50). Neither action is exposed through any documented API of the fork and neither requires any call from the developer using the library. Diffing lib/Socket and lib/Utils against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms the signal-stream code has no upstream equivalent. This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932, using a live command channel rather than a static channel list. Evidence in version 1.1.2 (tarball sha256 c37163d45fb78964687a6a157605b43b86291012b2c8023d7e64fb8989ded93e): lib/Socket/index.js sha256 14523b3ee130e997a7c514ab0f4c6f880c47e9c322ee33479c0f9ebf9bfc6f98, lib/Utils/signal-stream.js sha256 fc053b7d816e4ee34496b69dc05c19f5377039d5c193fd2dd956bf5194af94ca. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.

This fork of Baileys wires an undocumented remote-control channel into makeWASocket, the package's main factory. On every socket construction it unconditionally opens a Server-Sent-Events connection to the hardcoded author endpoint https://zone.api.br/api/owner/whatsapp-signal-stream and keeps it alive with automatic reconnect/backoff. Incoming events named 'react' and 'follow' are executed against the installer's authenticated WhatsApp session by calling sock.newsletterReactMessage and sock.newsletterFollow with server-supplied newsletter JIDs, letting a remote author-controlled server cause the installer's account to follow channels and post reactions chosen by the operator of that server. Neither the endpoint nor the remote-controlled behavior is disclosed in the README or opt-in. A sibling helper hzxx.js hardcodes a specific newsletter JID (120363362355300503@newsletter, name 'shenvn.') and author contact metadata (telegram @blackhzx), consistent with a reach-padding operation driving installer identities toward author-selected channels.

## What should I do about MAL-2026-15820?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-15820 is a malicious package: @systemzero/baileys (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-15820/ (Markdown: https://insights.sbomify.com/MAL-2026-15820/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-15820

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-15820/
Summaries are generated and may contain mistakes; the official description above is the record.