# MAL-2026-15919: Malicious code in megan-baileys (npm)


- **Type:** Malicious package
- **Package:** `megan-baileys` (npm)
- **Published:** 3 Sep 2026

## What is MAL-2026-15919?

MAL-2026-15919 is a malicious package in megan-baileys, published on 3 Sep 2026. 

### Official description

megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response is followed on the user's own authenticated WhatsApp session using the FOLLOW query id 7871414976211147. The follow list is therefore publisher-controlled at runtime, and the URL is hidden from a plaintext search. makeNewsletterSocket is reached from makeWASocket through lib/Socket/messages-send.js, so the behaviour fires for every consumer of the package with no opt-in. The base64 dead-drop and the follow loop are present in all ten published versions (1.0.0 through 1.0.11). No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. files.gifted.co.ke appears to be a file host used by a wider bot ecosystem and is deliberately not listed as an attacker domain. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys).

The package's postinstall script walks up from its own install location into the consumer's node_modules directory, removes any existing `@whiskeysockets/baileys` directory there, and writes a replacement `package.json` whose `main`/`exports` point back into megan-baileys' own `lib/index.mjs`. After installation, any code in the installer's project — including transitive dependencies that legitimately declare `@whiskeysockets/baileys` — that calls `require('@whiskeysockets/baileys')` will silently load megan-baileys code instead of the genuine Baileys library published under the @whiskeysockets scope by a different maintainer. This is a dependency-tree hijack executed at install time via a lifecycle hook: the installer's declared dependency graph is mutated to substitute an unrelated author's code for a widely-used scoped package the installer never chose to replace.

## What should I do about MAL-2026-15919?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-15919 is a malicious package: megan-baileys (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-15919/ (Markdown: https://insights.sbomify.com/MAL-2026-15919/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-15919

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-15919/
Summaries are generated and may contain mistakes; the official description above is the record.