MalwarePublished 12 Oct 2026

@astracode/byles-new (npm) · Malicious Code

Affects @astracode/byles-newSource GCVE Database

Malicious package : remove @astracode/byles-new and rotate any secrets on hosts that installed it.

Data as of 12 Oct 2026, 22:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17340

What to do

Remove @astracode/byles-new from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@astracode/byles-new	Affected 0.0.99 – 0.1.37 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @astracode/byles-new contains malicious code that silently subscribes a victim's authenticated WhatsApp account to attacker-controlled channels without consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query upon connection. The targeted WhatsApp channel IDs are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.

Impact

The impact is that a victim's WhatsApp account is silently subscribed to attacker-controlled channels without their knowledge or consent. This could lead to unwanted content or spam being delivered to the victim's WhatsApp account. However, the malicious code does not compromise account credentials, does not maintain persistence, and does not allow remote code execution, limiting the scope of the impact.

Defensive guidance

Users should avoid installing or using the affected versions of the @astracode/byles-new package and consider removing it if already installed.

Summary

The @astracode/byles-new npm package includes malicious functionality that automatically subscribes the user's authenticated WhatsApp account to channels controlled by the attacker. This is implemented by injecting a covert FOLLOW query into the WhatsApp socket connection process. The channel IDs targeted are either obfuscated or dynamically retrieved, enabling attackers to change subscription targets post-installation. The malicious behavior is limited to this subscription action and does not involve credential theft, persistence mechanisms, or arbitrary code execution.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Oct 2026, 22:49 UTC

Technical details

References

Community reviews