{"schema_version":"1.9.2","id":"MAL-2026-17408","published":"2026-10-29T13:33:50Z","modified":"2026-10-29T14:30:35.215432431Z","withdrawn":"2026-10-27T06:46:49Z","summary":"Malicious code in whalibmob (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: whalibmob (npm), version(s): 5.33.5, 5.33.4, 5.33.3, 5.33.2, 5.32.2, 5.32.1, 5.32.0, 5.30.0, 5.29.6, 5.29.5, 5.29.4, 5.29.3, 5.29.2, 5.29.1, 5.29.0, 5.28.0, 5.25.0, 5.24.2, 5.24.1, 5.24.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (091dbfc5e015710d33beb4bb706ba3bf44808312ba9f4e68b6bb389225d14911)\nPattern-based rules matched keyword co-occurrences in several files of this package: lib/MediaService.js imports fs/http/https and performs fs.readFileSync and https.request calls; lib/Registration.js contains the token 'ping' at multiple lines; lib/WebVersion.js references 'curl' and uses https.get alongside 'ps' tokens; and lib/socks.js references 'curl', 'POST', and 'hostname'. None of these matches, on their own, demonstrates reading installer-side secrets (such as ~/.aws, ~/.ssh, ~/.npmrc, environment credential variables, browser profile stores, or wallet files) and sending them to an attacker-controlled destination, nor install-time code execution of fetched content, nor a backdoor channel. No lifecycle script (preinstall/install/postinstall/prepare) is cited as invoking the flagged code paths at install time. No hardcoded attacker C2 endpoint, no known-bad-infrastructure host, no obfuscated destination, and no credential-grade file read is identified in the available evidence. The package name's similarity to common library naming conventions and the presence of generic network/filesystem primitives are not themselves attack indicators.\n","affected":[{"package":{"name":"whalibmob","ecosystem":"npm","purl":"pkg:npm/whalibmob"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["5.33.5","5.33.4","5.33.3","5.33.2","5.32.2","5.32.1","5.32.0","5.30.0","5.29.6","5.29.5","5.29.4","5.29.3","5.29.2","5.29.1","5.29.0","5.28.0","5.25.0","5.24.2","5.24.1","5.24.0","5.33.18","5.33.30","5.33.28","5.33.23","5.33.19","5.33.20","5.33.29","5.33.26","5.33.22","5.33.21"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/MediaService.js","sha256":"0790d0b1fd08b4a22a383c7520e2e037d08f151f544d02c5f20b7fd860d4730d","tlsh":"63620a973eb2a235066341d19b1fd05ad601c0273206eab0f74d85496fc7568e3b7fe9"},{"path":"lib/Registration.js","sha256":"8403f5a38b50a47440cc95001f56fc3656503f7355a1df2451cc21d978eb19b3","tlsh":"f1b31bdb266122320743f2b5561e74a6e3f5d116712ecab8714f91483f4e12843faafb"},{"path":"lib/WebVersion.js","sha256":"1bb81b4b86dad943c83c824e2449391fe24d737fe956ef6c039dcf88f4d27cc0","tlsh":"6f61b99b30e3d237069662c55b5f6091b73ae03b3262dad4f14f92914f4205883f6de5"},{"path":"lib/socks.js","sha256":"263125f009f413bd21ab04d9b340ea5d7dced6c5129baa82fa12f26a8a084c61","tlsh":"2ff1d895d2f0623741fb06e0621f93d5b728d127672aecaab16dd390bf0116843739fa"}],"package_integrity":[{"filename":"whalibmob-5.33.18.tgz","hashes":{"sha1":"4b5959a5d0a8ee13675fe90d290988c6e27445e9","sha512_sri":"sha512-qoesIcR4BnWViLjojOaMPTUsU7wHM1ic9139toip2WN3p4B8VNNxVRnL8LapAQ0BG1fhXYylP4CIgSqOHQgsAg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/whalibmob/MAL-2026-17408.json"}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.18"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whalibmob/v/5.33.21"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021986","import_time":"2026-10-29T13:37:18.773134914Z","modified_time":"2026-10-29T13:34:09Z","sha256":"30872166985b02e9f5caef507e1ca278b72cb39a7c5590efde672fc66e406daa","source":"amazon-inspector","versions":["5.33.18"]},{"id":"IN-MAL-2026-021984","import_time":"2026-10-29T13:37:18.716769116Z","modified_time":"2026-10-29T13:33:50Z","sha256":"944961a4308a7d6dd2100db691cf7ca5f0dc00433269ab48aa2fda11bad3d512","source":"amazon-inspector","versions":["5.33.30"]},{"id":"IN-MAL-2026-021985","import_time":"2026-10-29T13:37:18.741556631Z","modified_time":"2026-10-29T13:34:01Z","sha256":"ccd81d6a3ce15d6530e0c52c3fef94cf7a38c08c693b0edb099de358f95be4ea","source":"amazon-inspector","versions":["5.33.28"]},{"id":"IN-MAL-2026-022039","import_time":"2026-10-29T14:14:19.918292305Z","modified_time":"2026-10-29T13:40:50Z","sha256":"a053d57b5c6047e14d0e5df195f2a023fac53c3cf6be80f96ee662bdbb17d3bc","source":"amazon-inspector","versions":["5.33.23"]},{"id":"IN-MAL-2026-022046","import_time":"2026-10-29T14:14:20.661922458Z","modified_time":"2026-10-29T13:41:44Z","sha256":"b0e8ca28c57a049725bcf8c033b6aa6080e63e1aa9f58e9174588f1dd76e5e9c","source":"amazon-inspector","versions":["5.33.19"]},{"id":"IN-MAL-2026-022044","import_time":"2026-10-29T14:14:20.501150137Z","modified_time":"2026-10-29T13:41:27Z","sha256":"c4ae8297cce91c6d485eb97be14cf70dcc5fd5c881dd31c1a99ec32bcd3e832c","source":"amazon-inspector","versions":["5.33.20"]},{"id":"IN-MAL-2026-022040","import_time":"2026-10-29T14:14:20.092339214Z","modified_time":"2026-10-29T13:40:59Z","sha256":"091dbfc5e015710d33beb4bb706ba3bf44808312ba9f4e68b6bb389225d14911","source":"amazon-inspector","versions":["5.33.29"]},{"id":"IN-MAL-2026-022042","import_time":"2026-10-29T14:14:20.30041087Z","modified_time":"2026-10-29T13:41:13Z","sha256":"3d06867a2e52fdcaf03945b058cae5aee0901a96c1805e970de19a306a2f9402","source":"amazon-inspector","versions":["5.33.26"]},{"id":"IN-MAL-2026-022043","import_time":"2026-10-29T14:14:20.364114467Z","modified_time":"2026-10-29T13:41:21Z","sha256":"4b5f53e9a813cedbd91b8a829f274bd9aaeacb55d8de42df3e3e1463e167bc72","source":"amazon-inspector","versions":["5.33.22"]},{"id":"IN-MAL-2026-022045","import_time":"2026-10-29T14:14:20.586763789Z","modified_time":"2026-10-29T13:41:36Z","sha256":"58f586f9f306afb04550c568c3f61760f1e8b535b2b24a4d6d45a2715c2b478b","source":"amazon-inspector","versions":["5.33.21"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}