The baileys-xbats npm package is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This behavior affects versions 1.0.0 through 1.0.3. The malicious code issues authenticated FOLLOW queries using the victim's own WhatsApp session. The attack does not involve credential theft, persistence, or remote code execution.
The npm package @alipclutch/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected system should be rotated immediately from a secure, unaffected device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @fhkryxv/baileys versions 1.0.1 and 1.0.3 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription command into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @fhkryxv/baileys-new version 0.3.22 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change subscription targets after installation. This malicious behavior does not steal credentials, maintain persistence, or execute arbitrary code remotely.
The npm package @fazzcodestudio/fbot contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized control and access to secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
The npm package @we3js/framework contains malicious code that can fully compromise any computer on which it is installed or run. The presence of this package indicates a severe security risk, as attackers may gain full control of the affected system. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised device is strongly advised. However, removal of the package alone may not eliminate all malicious components introduced by the compromise.
The npm package @fazzcodestudio/baileys contains malicious code that fully compromises any computer on which it is installed or running. This compromise potentially exposes all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removing the package alone may not eliminate all malicious software. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package @fazzcodestudio/wa-web, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically uses the installer's authenticated WhatsApp session to subscribe the account to WhatsApp Channels chosen by the publisher without user consent. This behavior is enabled by default and undocumented, requiring manual configuration to disable. The package does not exfiltrate credentials or maintain persistence, but it covertly inflates channel subscribers using the victim's account. Versions 0.3.0 and 0.3.1 are affected.
The npm package '@fazzcodestudio/mediaformater' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @badzz88/eslint-config contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected computer should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @astracode/byles-new contains malicious code that silently subscribes a victim's authenticated WhatsApp account to attacker-controlled channels without consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query upon connection. The targeted WhatsApp channel IDs are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @modss/libsignal contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @mivesensei/baileys version 0.4.2 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's session. The targeted channel IDs are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @mikudeveloper/libsignal-node contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to potential persistent malicious software, complete remediation may require additional measures such as rotating all secrets and keys from a separate, trusted device.
The npm package @mikudeveloper/grace versions 2.0.1, 1.0.21, and 1.0.20 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the victim's authenticated WhatsApp session. The injected code does not steal credentials, maintain persistence, or execute arbitrary remote code, but it enables stealthy and flexible subscription to hidden or dynamically fetched channels.
The npm package @lekzo_dev/amprem contains malicious code that fully compromises any computer on which it is installed or running. The compromise may allow an attacker full control over the system, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised machine.
The npm package 'amprem' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The @kanaraa/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query using the installer's WhatsApp session. The targeted channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @jojoxyz/condemnedforce-baileys version 2.3.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The targeted channels are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @ikanngeming/ikannbail versions 1.0.2 through 1.0.7 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the installer's authenticated WhatsApp session to issue covert subscription requests. The targeted channels are obfuscated or dynamically fetched. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.