{"id":"MAL-2026-17408","revision":"aaa8bb4c63974f3d8b85d5f97d30cb31","records":[{"revision":"aaa8bb4c63974f3d8b85d5f97d30cb31","observedAt":"2026-10-29T15:12:22.973+00:00","statement":{"source":"osv","id":"MAL-2026-17408","aliases":[],"title":"Malicious code in whalibmob (npm)","description":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: whalibmob (npm), version(s): 5.33.5, 5.33.4, 5.33.3, 5.33.2, 5.32.2, 5.32.1, 5.32.0, 5.30.0, 5.29.6, 5.29.5, 5.29.4, 5.29.3, 5.29.2, 5.29.1, 5.29.0, 5.28.0, 5.25.0, 5.24.2, 5.24.1, 5.24.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (091dbfc5e015710d33beb4bb706ba3bf44808312ba9f4e68b6bb389225d14911)\nPattern-based rules matched keyword co-occurrences in several files of this package: lib/MediaService.js imports fs/http/https and performs fs.readFileSync and https.request calls; lib/Registration.js contains the token 'ping' at multiple lines; lib/WebVersion.js references 'curl' and uses https.get alongside 'ps' tokens; and lib/socks.js references 'curl', 'POST', and 'hostname'. None of these matches, on their own, demonstrates reading installer-side secrets (such as ~/.aws, ~/.ssh, ~/.npmrc, environment credential variables, browser profile stores, or wallet files) and sending them to an attacker-controlled destination, nor install-time code execution of fetched content, nor a backdoor channel. No lifecycle script (preinstall/install/postinstall/prepare) is cited as invoking the flagged code paths at install time. No hardcoded attacker C2 endpoint, no known-bad-infrastructure host, no obfuscated destination, and no credential-grade file read is identified in the available evidence. The package name's similarity to common library naming conventions and the presence of generic network/filesystem primitives are not themselves attack indicators.\n","state":2,"publishedAt":"2026-10-29T13:33:50+00:00","modifiedAt":"2026-10-29T14:30:35.2154324+00:00","affected":[{"ecosystem":"npm","name":"whalibmob","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":["5.33.5","5.33.4","5.33.3","5.33.2","5.32.2","5.32.1","5.32.0","5.30.0","5.29.6","5.29.5","5.29.4","5.29.3","5.29.2","5.29.1","5.29.0","5.28.0","5.25.0","5.24.2","5.24.1","5.24.0","5.33.18","5.33.30","5.33.28","5.33.23","5.33.19","5.33.20","5.33.29","5.33.26","5.33.22","5.33.21"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/","https://www.npmjs.com/package/whalibmob/v/5.33.18","https://www.npmjs.com/package/whalibmob/v/5.33.30","https://www.npmjs.com/package/whalibmob/v/5.33.28","https://www.npmjs.com/package/whalibmob/v/5.33.23","https://www.npmjs.com/package/whalibmob/v/5.33.19","https://www.npmjs.com/package/whalibmob/v/5.33.20","https://www.npmjs.com/package/whalibmob/v/5.33.29","https://www.npmjs.com/package/whalibmob/v/5.33.26","https://www.npmjs.com/package/whalibmob/v/5.33.22","https://www.npmjs.com/package/whalibmob/v/5.33.21"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17408","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17408","identifiers":["MAL-2026-17408"]},"retained":false,"historicalAffected":[]}],"coverage":[]}