Which versions of saturn-bail are malicious?

The following npm versions of saturn-bail are flagged malicious: 1.1.12. Treat any of these as compromised.

How do I remediate saturn-bail if I installed it?

saturn-bail is a typosquat — you almost certainly intended a legitimately-named package. Remove saturn-bail, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed saturn-bail — how do I know if it already compromised me?

If saturn-bail was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is saturn-bail part of a known attack campaign?

Yes — saturn-bail is associated with the IN-MAL-2026-004913 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find saturn-bail across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for saturn-bail (version 1.1.12). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging saturn-bail across your stack and pipelines.

Malicious package

saturn-bailnpm

Malicious code in saturn-bail (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-4818

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall saturn-bail

What this malware does

saturn-bail is a Baileys-derivative WhatsApp library that, on every makeWASocket() call, schedules a 90-second timer which executes newsletterWMexQuery("120363329486691279@newsletter", QueryIds.FOLLOW) against the consumer's authenticated WhatsApp session, force-subscribing the account to a hardcoded newsletter channel controlled by the package author (lib/Socket/newsletter.js:104-110). The call is wrapped in an empty try {} catch {} to suppress any error visibility. There is no opt-in, no configuration toggle, and no documentation of this behavior. Any developer or downstream end-user whose WhatsApp account is paired through a bot built on this library is silently enrolled into following the author's channel, inflating the author's subscriber count using third-party identities. The package additionally ships a reqPairing helper (lib/Socket/chats.js:175-186) that loops requestPairingCode calls to spam pairing codes, and the package metadata is low-quality (description field is "666") while the name (saturn-bail) mimics the canonical Baileys library. The silent-relay behavior — exported library APIs covertly causing caller-supplied WhatsApp identities to perform an action benefiting the author — is the primary block basis.

Malicious versions

1 flagged

1.1.12

Indicators of compromise (SHA-256)

9a29ae44bbeeb4d31d176d78d669615e7a508bd236620cc3724478100f9b6997

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for saturn-bail (version 1.1.12). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging saturn-bail across your stack and pipelines.
If you installed it — respond
saturn-bail is a typosquat — you almost certainly intended a legitimately-named package. Remove saturn-bail, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If saturn-bail was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks saturn-bail before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. saturn-bail on npm has been identified as a malicious package (version 1.1.12 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004913

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks saturn-bail-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring