{"schema_version":"1.9.2","id":"MAL-2026-17362","published":"2026-10-01T17:02:55Z","modified":"2026-10-29T13:48:10.463803371Z","summary":"Malicious code in @kelvdra/baileys (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @kelvdra/baileys (npm), version(s): 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (96f3f702084444337d5c3a9bc2b0945ecb49960a49e01008f2b3d381664310ba)\npackage.json declares `libsignal` as `github:Kelvdra/libsignal` — an off-registry, mutable git source with no commit SHA, no version pin, and no integrity check. On `npm install`, npm fetches whatever the referenced GitHub tree contains at that moment and installs it, executing any lifecycle scripts (preinstall/install/postinstall/prepare) the fetched repository declares. Whoever controls the `Kelvdra/libsignal` repository controls arbitrary code execution on the installer's machine at install time. The dependency name `libsignal` also mirrors the well-known WhatsApp/Signal library commonly consumed via the Baileys ecosystem, but resolution is redirected to an author-owned GitHub tree rather than a pinned registry release. The static `ping` rule hit in lib/Utils/generics.js is a keyword co-occurrence in an ID/version generation helper and does not itself indicate exfiltration.\n","affected":[{"package":{"name":"@kelvdra/baileys","ecosystem":"npm","purl":"pkg:npm/%40kelvdra/baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.6-rc.1","1.0.6","1.0.5-rc.3","1.0.6-rc.4","1.0.6-rc.5","1.0.6-rc.2","1.0.6-rc.6","1.0.6-rc.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"76ffcc4611eed87ec41e5c51d2cf17f07a2a98bed50de91dc06a278d23c79456","tlsh":"bb41ad11ca798cf305e532e868e65003a5304a479c58bc3c379d83ac9f8e25f77baa5d"}],"package_integrity":[{"filename":"baileys-1.0.6-rc.4.tgz","hashes":{"sha1":"f4da41c3c18c4029ddc69f2fb10efb519aba771c","sha512_sri":"sha512-leeWcoBw7hc/st5huMT3IUvAr+jjT6zyxM7XbBy10Mm5BqDIHJy3/yNSZIg/arLyTO9qF/n557FSy9yFdEDbIQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kelvdra/baileys/MAL-2026-17362.json"}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020868","import_time":"2026-10-01T17:18:04.314207215Z","modified_time":"2026-10-01T17:02:55Z","sha256":"839545967c959062f79d5b217758730bd2c6a69219949c2eea494e75e3cfc12a","source":"amazon-inspector","versions":["1.0.6-rc.4"]},{"id":"IN-MAL-2026-021937","import_time":"2026-10-29T13:37:17.277605321Z","modified_time":"2026-10-29T13:27:23Z","sha256":"125e133e11c0f24388c1610a2de538228dbf22e9068c84b43c3937267c2642f6","source":"amazon-inspector","versions":["1.0.6-rc.5"]},{"id":"IN-MAL-2026-021916","import_time":"2026-10-29T13:37:16.480545932Z","modified_time":"2026-10-29T13:24:47Z","sha256":"96f3f702084444337d5c3a9bc2b0945ecb49960a49e01008f2b3d381664310ba","source":"amazon-inspector","versions":["1.0.6-rc.2"]},{"id":"IN-MAL-2026-021891","import_time":"2026-10-29T13:37:15.314445366Z","modified_time":"2026-10-29T13:21:26Z","sha256":"c03b2c6e45f6dc046085d2308cc056e1661abf68175dfb9c1ee4f9f24eea2f22","source":"amazon-inspector","versions":["1.0.6-rc.1"]},{"id":"IN-MAL-2026-021888","import_time":"2026-10-29T13:37:15.17770967Z","modified_time":"2026-10-29T13:21:02Z","sha256":"cf1916cf8797b19f5aeb3cfac4c79b1541f45d0d9b1ad3b1a3ecb32fc282a73d","source":"amazon-inspector","versions":["1.0.6-rc.6"]},{"id":"IN-MAL-2026-021915","import_time":"2026-10-29T13:37:16.440240743Z","modified_time":"2026-10-29T13:24:40Z","sha256":"deeed9790272c214c35fb9df88d3067a32015413acf95c56ba9771c96317aaa0","source":"amazon-inspector","versions":["1.0.6-rc.3"]},{"id":"IN-MAL-2026-021919","import_time":"2026-10-29T13:37:16.562992084Z","modified_time":"2026-10-29T13:25:09Z","sha256":"f33bfe8dddf83a4ee2658588b80c751136c9fc28e3da2a9b4378f7f9c383a9a1","source":"amazon-inspector","versions":["1.0.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}