The npm package albert-anitabaileys version 1.1.13 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The npm package 'anuaja' versions 1.0.0, 1.1.0, and 1.1.1 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The cantarella-baileys npm package, versions 1.1.11 through 1.1.13, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channels are obfuscated or fetched dynamically to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The eliteprotech-baileys npm package versions 1.1.0, 1.1.1, and 1.1.2 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The focashi npm package version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious subscription targets are obfuscated or dynamically fetched, and the attack leverages the victim's own WhatsApp session. The code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The ishumdz-bail npm package is part of a large family of near-identical forks of the Baileys WhatsApp Web library that inject malicious code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The kasabaileys npm package is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. It uses the victim's authenticated WhatsApp session to issue a covert FOLLOW query to subscribe to these channels. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not steal credentials, maintain persistence, or execute arbitrary code. Affected versions include 0.3.15, 1.0.0, 1.0.1, and 1.0.2.
The keithbaileys npm package versions 1.0.8, 1.1.0, and 1.1.1 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket layer using the installer's authenticated session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package kiyoramarkets version 8.0.16 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channel identifiers are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The levvleys npm package, part of a large family of Baileys WhatsApp Web library forks, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. This covert subscription occurs via an injected FOLLOW query after connecting to WhatsApp, with target channels obfuscated or dynamically fetched. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package lilys-baileys (versions 1.3.2 and 1.3.3) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious code uses obfuscation techniques to hide the target channel identifiers and may fetch dynamic target lists from remote hosts. The attack leverages the installer's own authenticated WhatsApp session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package monte-md-baileys version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. It achieves this by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel identifiers are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or remote code execution.
The my-baileys npm package versions 1.0.1 through 1.0.5 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The noverojs npm package versions 1.0.1 and 1.0.4 contain malicious code that silently subscribes a victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The noxleyss npm package is part of a large family of malicious forks of the Baileys WhatsApp Web library that inject code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The noxxleys npm package, part of a large family of Baileys WhatsApp Web library forks, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The saturn-baileys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that injects covert subscription actions into the WhatsApp socket layer. Upon connection, it silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package shadowmd version 8.6.87 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious action abuses the installer's WhatsApp session to gain subscribers. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The spencer-baileys npm package version 1.0.4 is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the user's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The target channel identifiers are obfuscated or fetched remotely to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package syncxbails (versions 1.0.0 and 1.0.1) is part of a family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.