MalwarePublished 30 Sep 2026

whalibmob (npm) · Malicious Code

Affects whalibmobSource GCVE Database

Malicious package : remove whalibmob and rotate any secrets on hosts that installed it.

Data as of 30 Sep 2026, 16:00 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17408

What to do

Remove whalibmob from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmwhalibmob	Affected 5.24.0 – 5.33.5 20 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The whalibmob npm package contains malicious code that silently subscribes the installer's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs. The targeted JIDs are obfuscated or dynamically fetched to evade detection. The malicious behavior does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.

Impact

Victims unknowingly subscribe their WhatsApp accounts to attacker-controlled channels or newsletters, potentially exposing them to unwanted content or spam. The attack leverages the victim's authenticated session to perform these subscriptions silently. There is no direct credential theft, remote code execution, or persistence established by this malicious code.

Defensive guidance

Users should avoid installing or updating to the affected whalibmob package versions listed. Review and verify package sources before installation. Monitor for suspicious WhatsApp channel subscriptions and remove any unauthorized subscriptions. Since this is a malicious package behavior rather than a traditional vulnerability, remediation depends on avoiding use of the compromised package versions.

Summary

The whalibmob package, part of a large family of near-identical Baileys WhatsApp Web library forks, injects code that modifies the WhatsApp socket connection routine. Upon connection, it issues an authenticated 'w:mex' FOLLOW query using the installer's own WhatsApp session to subscribe the victim's account to attacker-controlled channels. The targeted channel JIDs are hidden via obfuscation or fetched dynamically from attacker-controlled hosts, allowing runtime modification of targets without republishing the package. This behavior abuses the installer's authenticated session to increase reach for attacker channels but does not involve credential theft, persistence, or arbitrary code execution.

References

ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Sep 2026, 16:00 UTC

Technical details

References

Community reviews