The noxleys npm package integrates an undocumented routine into the WhatsApp connection lifecycle that, upon connection opening, fetches a JSON list of channel IDs from a mutable, author-controlled GitHub raw URL. It then automatically invokes 'newsletterFollow' and 'newsletterMute' on the installer's authenticated WhatsApp account for each channel ID, with randomized delays and shuffling. This behavior is not disclosed in the package documentation and is not opt-in, effectively allowing the author to manipulate the user's WhatsApp account without permission. Additional helper functions fetch data from other mutable author-controlled GitHub URLs but do not execute code or run automatically at install time. There is no evidence of credential theft, environment scraping, or backdoor mechanisms. However, the mutable nature of the channel list means the author can change the followed accounts at any time without releasing a new package version. The package versions affected are 1.0.0, 1.1.0 through 1.1.6.

The malicious behavior causes the installer's WhatsApp account to automatically follow and mute channels controlled by the package author without user consent, potentially compromising user privacy and trust. Since the channel list is fetched from a mutable branch, the author can dynamically change which channels are followed, maintaining persistent unauthorized control over the user's WhatsApp interactions. Although no credential theft or system compromise is reported, the package effectively manipulates the user's account actions, which could lead to further indirect impacts such as spam or unwanted content exposure. The ghsa-malware source considers any system with this package installed as fully compromised, recommending immediate secret and key rotation and package removal.

Remove the noxleys package immediately from all affected systems. Rotate all secrets and keys stored on the compromised computer from a different, trusted device, as the package author may have gained control over the system's WhatsApp account. Since the malicious behavior relies on fetching data from mutable author-controlled GitHub URLs, avoid using this package or any forks thereof. No official patch or fix is available; the package should be considered malicious and untrusted. Monitor for any unauthorized WhatsApp activity and consider reinstalling WhatsApp or restoring from a clean backup if suspicious behavior persists.