critical severity ยท published 2026-11-03
An attacker silently subscribes the victim's WhatsApp account to attacker-controlled channels (120363418964199743@newsletter and 120363429190136593@newsletter) on every connect. All published versions of sauruspro-bail are malicious trojanized forks of the Baileys library.
Source: OSV
Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 2324 and your operating system.