LWA-2026-13072 confirmed malware

aemath-baileys@0.0.0-stage

Malicious code in aemath-baileys (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an empty placeholder published under a name that impersonates the legitimate `baileys` WhatsApp library — a combosquat that keeps the real name intact and adds a prefix. The published tarball contains only a package.json and a README (336 bytes total): no JavaScript, no lifecycle hooks, no dependencies, no bin entries, and no network indicators. The package's own description and README describe it as a "temporary package placeholder for staged publishing" / "temporary holding version" awaiting a staged release. No executable behaviour is present in this version; the analysis is metadata-only and no IOCs were observed.

analyzed by
Leitwacht
first seen
Oct 17, 2026, 02:32 PM
analyzed
Oct 17, 2026, 02:33 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.