{"id":"MAL-2026-17362","revision":"612e9a4d77de4930b2a2927809e18123","records":[{"revision":"612e9a4d77de4930b2a2927809e18123","observedAt":"2026-10-29T14:12:32.841+00:00","statement":{"source":"osv","id":"MAL-2026-17362","aliases":[],"title":"Malicious code in @kelvdra/baileys (npm)","description":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @kelvdra/baileys (npm), version(s): 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (96f3f702084444337d5c3a9bc2b0945ecb49960a49e01008f2b3d381664310ba)\npackage.json declares `libsignal` as `github:Kelvdra/libsignal` — an off-registry, mutable git source with no commit SHA, no version pin, and no integrity check. On `npm install`, npm fetches whatever the referenced GitHub tree contains at that moment and installs it, executing any lifecycle scripts (preinstall/install/postinstall/prepare) the fetched repository declares. Whoever controls the `Kelvdra/libsignal` repository controls arbitrary code execution on the installer's machine at install time. The dependency name `libsignal` also mirrors the well-known WhatsApp/Signal library commonly consumed via the Baileys ecosystem, but resolution is redirected to an author-owned GitHub tree rather than a pinned registry release. The static `ping` rule hit in lib/Utils/generics.js is a keyword co-occurrence in an ID/version generation helper and does not itself indicate exfiltration.\n","state":0,"publishedAt":"2026-10-01T17:02:55+00:00","modifiedAt":"2026-10-29T13:48:10.4638034+00:00","affected":[{"ecosystem":"npm","name":"@kelvdra/baileys","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":["1.0.6-rc.1","1.0.6","1.0.5-rc.3","1.0.6-rc.4","1.0.6-rc.5","1.0.6-rc.2","1.0.6-rc.6","1.0.6-rc.3"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.4","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.5","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.2","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.1","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.6","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6-rc.3","https://www.npmjs.com/package/@kelvdra/baileys/v/1.0.6"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17362","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17362","identifiers":["MAL-2026-17362"]},"retained":false,"historicalAffected":[]}],"coverage":[]}