{"schema_version":"1.9.2","id":"MAL-2026-17408","published":"2026-10-29T13:33:50Z","modified":"2026-10-29T13:48:11.426788981Z","withdrawn":"2026-10-27T06:46:49Z","summary":"Malicious code in whalibmob (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: whalibmob (npm), version(s): 5.33.5, 5.33.4, 5.33.3, 5.33.2, 5.32.2, 5.32.1, 5.32.0, 5.30.0, 5.29.6, 5.29.5, 5.29.4, 5.29.3, 5.29.2, 5.29.1, 5.29.0, 5.28.0, 5.25.0, 5.24.2, 5.24.1, 5.24.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ccd81d6a3ce15d6530e0c52c3fef94cf7a38c08c693b0edb099de358f95be4ea)\nThe package ships several modules combining filesystem reads, HTTPS/HTTP requests, and shell-related tokens: lib/MediaService.js imports fs, http, and https and performs fs.readFileSync and https.request calls; lib/Registration.js contains repeated references to 'ping'; lib/WebVersion.js references 'curl', 'ps', and https.get; lib/socks.js references 'curl', 'POST', and 'hostname'. The package name resembles a well-known library family, and the module names (MediaService, Registration, WebVersion, socks) do not match any documented purpose that was identified. The co-occurrence of network, filesystem, and process primitives in multiple files is consistent with both legitimate library composition and exfiltration tooling; no specific installer-side data read or non-first-party destination was identified in the available evidence, so the pattern-match alone does not establish an attacker-benefit flow.\n","affected":[{"package":{"name":"whalibmob","ecosystem":"npm","purl":"pkg:npm/whalibmob"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["5.33.5","5.33.4","5.33.3","5.33.2","5.32.2","5.32.1","5.32.0","5.30.0","5.29.6","5.29.5","5.29.4","5.29.3","5.29.2","5.29.1","5.29.0","5.28.0","5.25.0","5.24.2","5.24.1","5.24.0","5.33.18","5.33.30","5.33.28"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/MediaService.js","sha256":"0790d0b1fd08b4a22a383c7520e2e037d08f151f544d02c5f20b7fd860d4730d","tlsh":"63620a973eb2a235066341d19b1fd05ad601c0273206eab0f74d85496fc7568e3b7fe9"},{"path":"lib/Registration.js","sha256":"8403f5a38b50a47440cc95001f56fc3656503f7355a1df2451cc21d978eb19b3","tlsh":"f1b31bdb266122320743f2b5561e74a6e3f5d116712ecab8714f91483f4e12843faafb"},{"path":"lib/WebVersion.js","sha256":"1bb81b4b86dad943c83c824e2449391fe24d737fe956ef6c039dcf88f4d27cc0","tlsh":"6f61b99b30e3d237069662c55b5f6091b73ae03b3262dad4f14f92914f4205883f6de5"},{"path":"lib/socks.js","sha256":"263125f009f413bd21ab04d9b340ea5d7dced6c5129baa82fa12f26a8a084c61","tlsh":"2ff1d895d2f0623741fb06e0621f93d5b728d127672aecaab16dd390bf0116843739fa"}],"package_integrity":[{"filename":"whalibmob-5.33.18.tgz","hashes":{"sha1":"4b5959a5d0a8ee13675fe90d290988c6e27445e9","sha512_sri":"sha512-qoesIcR4BnWViLjojOaMPTUsU7wHM1ic9139toip2WN3p4B8VNNxVRnL8LapAQ0BG1fhXYylP4CIgSqOHQgsAg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/whalibmob/MAL-2026-17408.json"}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.18"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.28"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021986","import_time":"2026-10-29T13:37:18.773134914Z","modified_time":"2026-10-29T13:34:09Z","sha256":"30872166985b02e9f5caef507e1ca278b72cb39a7c5590efde672fc66e406daa","source":"amazon-inspector","versions":["5.33.18"]},{"id":"IN-MAL-2026-021984","import_time":"2026-10-29T13:37:18.716769116Z","modified_time":"2026-10-29T13:33:50Z","sha256":"944961a4308a7d6dd2100db691cf7ca5f0dc00433269ab48aa2fda11bad3d512","source":"amazon-inspector","versions":["5.33.30"]},{"id":"IN-MAL-2026-021985","import_time":"2026-10-29T13:37:18.741556631Z","modified_time":"2026-10-29T13:34:01Z","sha256":"ccd81d6a3ce15d6530e0c52c3fef94cf7a38c08c693b0edb099de358f95be4ea","source":"amazon-inspector","versions":["5.33.28"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}