malicious-packages database. There is no coordinated-disclosure window (the maintainer is the attacker). codelake never stores raw payloads — only the detection rule, file:line, and IOCs.
@crysnovax/baileys — malicious npm package, independently detected and OSV-corroborated
@crysnovax/baileys is a malicious npm package that codelake Research independently detected during automated supply-chain scanning, corroborated by MAL-2026-15917 in OSV. The detection signal and affected versions are detailed below.
codelake's analysis classifies the detection signal as behaviour that harvests local credentials, SSH keys, cloud secrets or API keys.
Affected version(s): 2.7.10, 2.7.11, 2.7.13, 2.7.14, 2.7.15, 2.7.16, 2.7.20, 2.8.1, 2.8.2.
codelake's per-ecosystem scanners flagged the specimen and the AI-triage judge classified it malicious (recorded signal: GCP API Key, confidence 0.90).
This is an independent detection by codelake's own scanners and AI-triage pipeline; it is corroborated by MAL-2026-15917 in OSV (codelake was not necessarily the first public reporter for this record).
All analysis is performed at the indicator level on extracted source only — codelake never executes specimens and stores only the detection rule, indicators and analysis, never raw payloads.
Detected independently by codelake Research · automated per-ecosystem supply-chain scanning + AI-triage, verified at the indicator level on extracted source (no execution). Corroborated by MAL-2026-15917 in OSV. codelake stores only the detection rule, indicators and analysis, never raw payloads.