The npm package @revizahoshii/hoshino-native contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @revizahoshii/hoshino-voip contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection because the attacker may have established persistent control over the system.
The npm package @revizahoshii/hoshino-wam contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remove the malicious software or restore system integrity.
The npm package @revizahoshii/hoshino-mcp-server contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but it may not fully eliminate the malicious presence. Secrets and keys should be rotated from a separate, trusted machine to mitigate ongoing risk.
The npm package @revizahoshii/hoshino-media-utils contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee full remediation, as the attacker may have established persistent control over the system.
The npm package '@revizahoshii/hoshino-store-postgres' contains malicious code that fully compromises any computer on which it is installed or running. Installation of this package may result in complete system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised system.
The npm package '@revizahoshii/hoshino-store-sqlite' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removing the package alone may not eliminate all malicious software. Secrets and keys should be rotated from a separate, uncompromised system.
The npm package @revizahoshii/hoshino-store-mongo contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious components, as the attacker may have established persistent control over the system.
The npm package '@revizahoshii/hoshino-store-mysql' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the potential for persistent malicious software, all secrets and keys stored on the compromised machine should be rotated from a different, secure device.
The npm package @revizahoshii/hoshino-store-redis contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys. Removal of the package does not guarantee elimination of all malicious components, as the attacker may have established persistent control.
The npm package @revizahoshii/baileys contains malicious code that silently subscribes a victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting covert subscription actions into the WhatsApp socket layer using the installer's authenticated session. The targeted channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or enable remote code execution.
The npm package @revizahoshii/hoshino version 1.1.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code abuses the authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The baileys-xbats npm package is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This behavior affects versions 1.0.0 through 1.0.3. The malicious code issues authenticated FOLLOW queries using the victim's own WhatsApp session. The attack does not involve credential theft, persistence, or remote code execution.
The npm package @alipclutch/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected system should be rotated immediately from a secure, unaffected device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @fhkryxv/baileys versions 1.0.1 and 1.0.3 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription command into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @fhkryxv/baileys-new version 0.3.22 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, allowing attackers to change subscription targets after installation. This malicious behavior does not steal credentials, maintain persistence, or execute arbitrary code remotely.
The npm package @fazzcodestudio/fbot contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized control and access to secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
The npm package @we3js/framework contains malicious code that can fully compromise any computer on which it is installed or run. The presence of this package indicates a severe security risk, as attackers may gain full control of the affected system. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised device is strongly advised. However, removal of the package alone may not eliminate all malicious components introduced by the compromise.
The npm package @fazzcodestudio/baileys contains malicious code that fully compromises any computer on which it is installed or running. This compromise potentially exposes all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removing the package alone may not eliminate all malicious software. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package @fazzcodestudio/wa-web, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically uses the installer's authenticated WhatsApp session to subscribe the account to WhatsApp Channels chosen by the publisher without user consent. This behavior is enabled by default and undocumented, requiring manual configuration to disable. The package does not exfiltrate credentials or maintain persistence, but it covertly inflates channel subscribers using the victim's account. Versions 0.3.0 and 0.3.1 are affected.