Malicious Package Affecting @kanaraa/baileys package, versions =3.1.8=3.1.9=3.2.0=3.3.0=3.4.0=3.4.1=3.5.0=3.4.2=3.4.4=3.4.5=3.4.6=3.4.7=3.5.1=3.5.2*
Threat Intelligence
Exploit Maturity
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Attacked
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-KANARAABAILEYS-20336186
- published30 Sept 2026
- disclosed30 Sept 2026
- creditUnknown
Introduced: 30 Sep 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Avoid using all malicious instances of the @kanaraa/baileys package.
Overview
@kanaraa/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.