Supply chain · npm · High

Critical Malware Alert: npm package @lordmega/baileys Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-26

The npm package `@lordmega/baileys` has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately from a separate, secure machine. Removing the package alone may not fully remediate the compromise.

  • Package: npm / @lordmega/baileys
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The npm package `@lordmega/baileys` contains malware. Installation or execution of this package results in a complete compromise of the host system. The advisory explicitly states that full control of the computer may be ceded to an external entity.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When developers or automated systems integrate this package into their projects, the malicious code executes, typically during installation or runtime. This can lead to unauthorized access, data exfiltration, or further compromise of the affected system, often targeting credentials or secrets.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has installed or run `@lordmega/baileys`

Conditions that increase exposure

  • Projects with unpinned dependencies that might inadvertently pull the malicious package
  • Lack of lockfiles (e.g., `package-lock.json`) allowing arbitrary version resolution
  • Use of internal mirrors or caches that may have ingested the malicious package
  • Automated build systems that install dependencies without strict vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system.
  • All secrets and keys stored on the affected computer are exposed and potentially exfiltrated.
  • The compromised system could be used as a pivot point for further attacks within the network.

What to do (defensive)

Detect

  • Scan dependency trees for `@lordmega/baileys` in any version.
  • Review package installation logs for evidence of `@lordmega/baileys` being pulled.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified as having installed or run `@lordmega/baileys`.
  • Block `@lordmega/baileys` from being downloaded or installed from all package registries and mirrors.
  • Review and revoke API keys, tokens, and credentials that were accessible from compromised systems.

Remediate

  • Consider any system that installed `@lordmega/baileys` as fully compromised and rebuild it from a trusted image.
  • Rotate all secrets, keys, and credentials that were present on or accessible from the compromised computer, performing this action from a separate, secure system.
  • Even after removal, assume persistence and conduct a thorough forensic analysis to ensure no other malicious software remains.

Frontier verdict — High

Prioritize immediate detection and isolation of systems that installed `@lordmega/baileys` due to critical system compromise and credential theft.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.