The npm package @bellaxchuu/privatebails version 1.4.1 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched to evade detection. This behavior abuses the victim's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/skyblue version 2.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel identifiers are obfuscated or dynamically fetched at runtime to evade detection. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/velvetry versions 0.1.3 and 0.1.4 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert subscription action into the WhatsApp socket layer, leveraging the installer's authenticated WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/xtrxbails (version 0.0.8) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, preventing easy detection. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The @hanzofc/baileys npm package versions 7.0.0 and 7.0.1 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert follow query into the WhatsApp socket connection, leveraging the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @ikyyjee/ikkysingle version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious code uses obfuscation techniques to hide the target channel identifiers and may fetch updated target lists at runtime. This behavior abuses the installer's authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package @ikyyjee/ikyysinggle version 1.7.7 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched to evade detection. This malicious behavior abuses the installer's WhatsApp session to increase subscribers for attacker channels but does not steal credentials or execute arbitrary code.
The npm package @ikyyjee/ikyysingle version 1.7.8 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious code uses the victim's own WhatsApp session to issue subscription requests. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The @japofc/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @lendkzn/xntaabail version 7.0.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or fetched dynamically, and the malicious action uses the installer's own WhatsApp session to perform the subscription. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The @levvicode/baileys npm package versions 0.0.2 and 0.0.3 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @noxleyss/baileys version 1.1.10 is part of a family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The subscription targets are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @nyzzpedia/baileys-new version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing an authenticated FOLLOW query using the victim's own session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. This behavior does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @nyzzpediaa/baileys-new contains malicious code that silently subscribes the installer's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel IDs are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @ostyado/baileys versions 2.0.6 through 2.0.9 contains malicious code that silently subscribes the user's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection, using the victim's own session. The targeted channels are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, establish persistence, or execute arbitrary code.
The @queenanya/baileys npm package versions 9.10.1, 9.7.3-beta.1, and 9.7.2 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel identifiers are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The @rennnpm/baileys npm package version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated 'w:mex' FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The @teamolduser/baileys npm package contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, establish persistence, or execute arbitrary code.
The npm package @xatancchii/velycxbail version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The @xayz/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The target channels are obfuscated using various techniques and may be dynamically fetched from attacker-controlled sources. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.