MalwarePublished 7 Oct 2026Updated 16 Oct 2026

@ikyyjee/ikkysingle (npm) · Malicious Code

Affects @ikyyjee/ikkysingleSource GCVE Database

Malicious package : remove @ikyyjee/ikkysingle and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17356

What to do

Remove @ikyyjee/ikkysingle from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@ikyyjee/ikkysingle	Affected =0.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @ikyyjee/ikkysingle version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious code uses obfuscation techniques to hide the target channel identifiers and may fetch updated target lists at runtime. This behavior abuses the installer's authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Impact

The impact is unauthorized subscription of the victim's WhatsApp account to attacker-controlled channels, potentially leading to unwanted content delivery or spam. There is no credential theft, persistence, or remote code execution associated with this threat. The victim's WhatsApp session is abused to silently follow channels without their knowledge or consent.

Defensive guidance

Since this is a malicious package, the primary mitigation is to avoid installing or using the @ikyyjee/ikkysingle package version 0.1.2 and other related malicious forks. Users should verify the authenticity of npm packages before installation and consider removing any installations of this package. Monitoring for suspicious WhatsApp channel subscriptions may help detect compromise.

Summary

The @ikyyjee/ikkysingle package (version 0.1.2) is a malicious fork of the Baileys WhatsApp Web library that injects a covert subscription action into the WhatsApp socket connection. Upon connecting, it issues an authenticated FOLLOW query using the victim's WhatsApp session to subscribe the account to attacker-chosen WhatsApp channels. The target channel JIDs are obfuscated or dynamically fetched to evade detection. This mechanism is consistent across a family of over 100 similar malicious forks. The attack leverages the installer's own authenticated session to increase subscribers for attacker channels but does not perform credential theft, persistence, or arbitrary code execution.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:06 UTC

Technical details

References

Community reviews