The npm package @wenzyx1/bails versions 1.0.0 and 1.0.1 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's session. The targeted channels are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @sanzoffc/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The npm package @sakataoffc/baileys is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This subscription leverages the victim's authenticated session and uses obfuscated or dynamically fetched target channels to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @sairidev/baileys-new version 0.3.21 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The malicious action leverages the authenticated WhatsApp session of the installer by injecting covert subscription commands into the WhatsApp socket connection. The targeted channels are obfuscated or dynamically fetched, allowing attackers to change targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @saazkira/eslint-config contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removing the package alone may not eliminate all malicious components.
The npm package @saazkira/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The @saazkira/baileys npm package versions 2.1.6 through 2.1.9 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @revizahoshii/hoshino-fake-server contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected computer. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.
The npm package @revizahoshii/hoshino-native contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @revizahoshii/hoshino-voip contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection because the attacker may have established persistent control over the system.
The npm package @revizahoshii/hoshino-wam contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remove the malicious software or restore system integrity.
The npm package @revizahoshii/hoshino-mcp-server contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but it may not fully eliminate the malicious presence. Secrets and keys should be rotated from a separate, trusted machine to mitigate ongoing risk.
The npm package @revizahoshii/hoshino-media-utils contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee full remediation, as the attacker may have established persistent control over the system.
The npm package '@revizahoshii/hoshino-store-postgres' contains malicious code that fully compromises any computer on which it is installed or running. Installation of this package may result in complete system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised system.
The npm package '@revizahoshii/hoshino-store-sqlite' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removing the package alone may not eliminate all malicious software. Secrets and keys should be rotated from a separate, uncompromised system.
The npm package @revizahoshii/hoshino-store-mongo contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious components, as the attacker may have established persistent control over the system.
The npm package '@revizahoshii/hoshino-store-mysql' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the potential for persistent malicious software, all secrets and keys stored on the compromised machine should be rotated from a different, secure device.
The npm package @revizahoshii/hoshino-store-redis contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys. Removal of the package does not guarantee elimination of all malicious components, as the attacker may have established persistent control.
The npm package @revizahoshii/baileys contains malicious code that silently subscribes a victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting covert subscription actions into the WhatsApp socket layer using the installer's authenticated session. The targeted channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or enable remote code execution.
The npm package @revizahoshii/hoshino version 1.1.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code abuses the authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.