Poisoned Pipeline / Incidents / AS85
Baileys npm forks farming WhatsApp Channel follows
SafeDep tracked a campaign of npm packages that fork the Baileys
WhatsApp library so that a developer’s own WhatsApp account follows
attacker channels on install/use, inflating follower counts and
injecting advertising. Abuse of a real messaging API from a lookalike
dependency, not a classic infostealer. OX Security (28 Sep 2026)
counted 101 packages in the same campaign, about 490,000 downloads,
with 16 removed as of that date. One variant fetches the channel list
from a GitHub repo at runtime; others hardcode it in cleartext or
base64. No credential theft in that write-up.
Mapped techniques
supply-chain forked library abuse
Baileys forks/lookalikes on npm.
Packages that drive WhatsApp Channel follows.
Runs with the victim’s WhatsApp session.