Multiple vulnerabilities in the pcre2 library used by Red Hat Enterprise Linux 8 allow out-of-bounds reads and writes, integer overflow, incorrect memory free operations, and information disclosure. These issues affect various functions including pcre2_dfa_match, JIT fallback, pcre2_compile_32 on 32-bit platforms, and pcre2_serialize_encode. The vulnerabilities can lead to memory corruption and potential information leakage. Red Hat has released security updates addressing these issues.
A vulnerability in urllib3 versions 1.26.0 through 2.7.0 causes improper separation of TLS configurations between HTTPS proxies and target servers. This can result in the proxy TLS connection using the target server's SSL context and certificate verification policies, potentially disabling proxy certificate verification. An attacker intercepting the HTTPS proxy connection could impersonate the proxy, exposing sensitive data and client TLS identity information. The issue affects HTTPS forwarding proxy configurations and is fixed in urllib3 version 2.8.0 and later.
The npm package @wanzlonely/bails4u versions 2.0.0, 3.0.0, 4.0.0, and 5.0.0 are malicious forks of the Baileys WhatsApp Web library. These versions contain injected code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code, and the targeted channels are obfuscated or dynamically fetched to evade detection.
The npm package @wenzyx1/bails versions 1.0.0 and 1.0.1 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's session. The targeted channels are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @sakataoffc/baileys is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This subscription leverages the victim's authenticated session and uses obfuscated or dynamically fetched target channels to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @sairidev/baileys-new version 0.3.21 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The malicious action leverages the authenticated WhatsApp session of the installer by injecting covert subscription commands into the WhatsApp socket connection. The targeted channels are obfuscated or dynamically fetched, allowing attackers to change targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The @saazkira/baileys npm package versions 2.1.6 through 2.1.9 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @revizahoshii/baileys contains malicious code that silently subscribes a victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting covert subscription actions into the WhatsApp socket layer using the installer's authenticated session. The targeted channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or enable remote code execution.
The npm package @revizahoshii/hoshino version 1.1.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code abuses the authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The baileys-xbats npm package is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This behavior affects versions 1.0.0 through 1.0.3. The malicious code issues authenticated FOLLOW queries using the victim's own WhatsApp session. The attack does not involve credential theft, persistence, or remote code execution.
The npm package @fhkryxv/baileys versions 1.0.1 and 1.0.3 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription command into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @fhkryxv/baileys-new version 0.3.22 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change subscription targets after installation. This malicious behavior does not steal credentials, maintain persistence, or execute arbitrary code remotely.
The npm package @astracode/byles-new contains malicious code that silently subscribes a victim's authenticated WhatsApp account to attacker-controlled channels without consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query upon connection. The targeted WhatsApp channel IDs are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @mivesensei/baileys version 0.4.2 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's session. The targeted channel IDs are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @mikudeveloper/grace versions 2.0.1, 1.0.21, and 1.0.20 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the victim's authenticated WhatsApp session. The injected code does not steal credentials, maintain persistence, or execute arbitrary remote code, but it enables stealthy and flexible subscription to hidden or dynamically fetched channels.
The @kanaraa/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query using the installer's WhatsApp session. The targeted channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @jojoxyz/condemnedforce-baileys version 2.3.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The targeted channels are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @ikanngeming/ikannbail versions 1.0.2 through 1.0.7 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the installer's authenticated WhatsApp session to issue covert subscription requests. The targeted channels are obfuscated or dynamically fetched. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The arsya-baileys npm package version 9.2.0 and related versions are malicious forks of the Baileys WhatsApp Web library. They inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels by issuing authenticated FOLLOW queries using the victim's own session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package 'bungoma' versions 1.0.0, 1.0.1, and 1.1.0 are malicious forks of the Baileys WhatsApp Web library. These versions contain code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, enabling attackers to change subscription targets after installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.