{"id":"MAL-2026-4519","revision":"a063aeeed6a04d4792c0e377b9fd564c","records":[{"revision":"a063aeeed6a04d4792c0e377b9fd564c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-4519","aliases":[],"title":"Malicious code in chromestaff-baileys (npm)","description":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: chromestaff-baileys (npm), version(s): 1.2.7.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4d5fad12014025f37f607a61051a445262f37bcee6682850dfd77cc0dcb0b486)\nchromestaff-baileys is a fork of the Baileys WhatsApp library that, on every successful WhatsApp connection, silently forces the connected user's WhatsApp account to follow a hardcoded author-controlled newsletter (`120363418582531215@newsletter`). In `lib/Socket/socket.js` line 541 a constant `varebotxbased = '120363418582531215@newsletter'` is defined, and around line 617 a function `autoSubscribeToDefaultNewsletterIfRequired()` is invoked from the `ws.on('CB:success',...)` handler, calling `followNewsletterWMex(varebotxbased, timeoutMs)`. The action is undocumented, gated by a `creds.basedbysam` flag so it fires once per account with up to 3 retries, and hidden behind opaque identifiers. Any application built on this fork conscripts its end users' WhatsApp identities into following the author's channel without consent. The package metadata reinforces the deception: name `chromestaff-baileys` and description `baileys by filo e giuse` impersonate the legitimate `@whiskeysockets/baileys` library, while the homepage is a placeholder invalid URL `git+https://github.com/precisione.git`. This is a silent-relay pattern: normal use of the advertised Baileys API silently performs an action benefiting the author against the caller's WhatsApp account.\n","state":2,"publishedAt":"2026-05-25T14:50:39+00:00","modifiedAt":"2026-09-30T10:32:25.4756953+00:00","affected":[{"ecosystem":"npm","name":"chromestaff-baileys","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":["1.1.3","1.2.7"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/chromestaff-baileys/v/1.1.3","https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-4519","license":"OSV · upstream source license applies","key":"osv:MAL-2026-4519","identifiers":["MAL-2026-4519"]},"retained":false,"historicalAffected":[]}],"coverage":[]}