490,000 Downloads of 101 Baileys npm Forks Feed Indonesian WhatsApp Subscriber Networks

OX Security identified three variants across the packages. Variant 1 pulls channel IDs from GitHub at runtime in 19 packages. Variant 2 hardcodes IDs in cleartext across 60 packages. Variant 3 uses encoded IDs in 14 packages. Shared channel IDs, GitHub accounts, and subscription targets link packages published under different names, indicating coordinated operation rather than independent actors. Downloads concentrate on forks mimicking the legitimate @whiskeysockets/baileys library.

SafeDep first flagged Baileys forks in August 2026 for stealth channel follows and ad injection. Xygeni later detailed @dappaoffc/baileys-mod newsletter subscriptions. OX expanded the cluster to 101 packages tied to Indonesian bot-sale channels marketing Mobile Legends accounts and resource marketplaces. Follower counts on groups like Fyxzpedia.ID serve as social proof for paid bot scripts and premium APKs.

This campaign exploits npm's trust model where developers pull WhatsApp automation libraries for legitimate bots yet expose authenticated sessions. The pattern mirrors prior supply-chain abuses where small-scale operators reuse infrastructure across repackaged packages. Shared beneficiaries collect followers across variants, concentrating value on Indonesian business accounts.

Next steps include npm registry takedowns of remaining forks, developer audits for Baileys dependencies, and runtime detection rules for unauthorized group additions. Expect additional obfuscated variants within 60 days as operators rotate GitHub hosts.