MalwarePublished 12 Aug 2026

noxleys (npm) · Malicious Code

Affects noxleysSource GCVE Database

Malicious package : remove noxleys and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:41 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13831

What to do

Remove noxleys from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnoxleys	Affected 1.0.0 – 1.1.6 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The noxleys npm package, a fork of the Baileys WhatsApp library, contains malicious code that automatically follows and mutes WhatsApp channels controlled by the package author without user consent. This behavior is triggered on every WhatsApp connection update when the connection opens, after a 30-second delay, by fetching a mutable list of channel IDs from an author-controlled GitHub URL. The package does not disclose this behavior and uses the installer's authenticated WhatsApp account to perform these actions. No credential theft or environment scraping is reported, but the package effectively grants the author control over the user's WhatsApp interactions. The package versions 1.0.0 through 1.1.6 are affected.

Impact

The malicious behavior causes the installer's WhatsApp account to automatically follow and mute channels controlled by the package author without user consent, potentially compromising user privacy and trust. Since the channel list is fetched from a mutable branch, the author can dynamically change which channels are followed, maintaining persistent unauthorized control over the user's WhatsApp interactions. Although no credential theft or system compromise is reported, the package effectively manipulates the user's account actions, which could lead to further indirect impacts such as spam or unwanted content exposure. The ghsa-malware source considers any system with this package installed as fully compromised, recommending immediate secret and key rotation and package removal.

Defensive guidance

Remove the noxleys package immediately from all affected systems. Rotate all secrets and keys stored on the compromised computer from a different, trusted device, as the package author may have gained control over the system's WhatsApp account. Since the malicious behavior relies on fetching data from mutable author-controlled GitHub URLs, avoid using this package or any forks thereof. Monitor for any unauthorized WhatsApp activity and consider reinstalling WhatsApp or restoring from a clean backup if suspicious behavior persists.

Summary

The noxleys npm package integrates an undocumented routine into the WhatsApp connection lifecycle that, upon connection opening, fetches a JSON list of channel IDs from a mutable, author-controlled GitHub raw URL. It then automatically invokes 'newsletterFollow' and 'newsletterMute' on the installer's authenticated WhatsApp account for each channel ID, with randomized delays and shuffling. This behavior is not disclosed in the package documentation and is not opt-in, effectively allowing the author to manipulate the user's WhatsApp account without permission. Additional helper functions fetch data from other mutable author-controlled GitHub URLs but do not execute code or run automatically at install time. There is no evidence of credential theft, environment scraping, or backdoor mechanisms. However, the mutable nature of the channel list means the author can change the followed accounts at any time without releasing a new package version. The package versions affected are 1.0.0, 1.1.0 through 1.1.6.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:41 UTC

Technical details

References

Community reviews