0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
systemzero-baileys
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting systemzero-baileys, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-15820 | Unknown | Malicious code in @systemzero/baileys (npm)@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events |
| OSV (opens in a new tab) |
@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNAL_STREAM_URL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket(), the library's socket-creation entrypoint, calls listenToSignalStream(sock, { url: SIGNAL_STREAM_URL }) unconditionally on every socket it creates; no configuration option disables it. lib/Utils/signal-stream.js opens a persistent server-sent-events connection to that URL (fetch with Accept: text/event-stream, line 69) and executes the events