The npm package @ikyyjee/ikkysingle version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious code uses obfuscation techniques to hide the target channel identifiers and may fetch updated target lists at runtime. This behavior abuses the installer's authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package @ikyyjee/ikyysinggle version 1.7.7 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched to evade detection. This malicious behavior abuses the installer's WhatsApp session to increase subscribers for attacker channels but does not steal credentials or execute arbitrary code.
The npm package @ikyyjee/ikyysingle version 1.7.8 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious code uses the victim's own WhatsApp session to issue subscription requests. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The npm package 'waie-crash-baileys' contains malicious code or depends on a malicious package. Installing or running this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different machine is strongly advised.
The npm package css-jptvix-polyfill version 1.0.0 contains malicious code that mimics internal Wix thunderbolt modules to trigger its payload when imported. Upon loading, it executes system commands to gather environment details and sends this sensitive information to a hardcoded external server. It also downloads and executes attacker-controlled JavaScript, potentially establishing a reverse shell on the victim's machine. This behavior indicates a dependency confusion attack targeting Wix thunderbolt builds.
The npm package @kxa/xbails version 0.0.5 is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. It achieves this by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The @badzz88/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code. The targeted channel IDs are obfuscated or fetched remotely, allowing attackers to change targets after installation.
The npm package 'serpacksven1' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'serpacksven2' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise potentially grants an attacker full control over the affected system. Immediate removal of the package is recommended, but due to the severity of the compromise, simply removing the package may not eliminate all malicious components. All secrets and keys stored on the compromised system should be rotated from a separate, secure device.
The npm package 'documenclient' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by an attacker.
The npm package 'serpacksven' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious components, as the attacker may have gained full control of the system.
The dzyhaxz-baileys npm package is a malicious fork of the Baileys WhatsApp library that automatically causes WhatsApp-authenticated users to follow a hardcoded channel without their consent. It also aliases critical cryptographic dependencies to author-controlled packages with mutable version tags, enabling supply-chain manipulation. This behavior violates the package's own documentation and poses a deceptive supply-chain risk. Although it does not steal credentials or enable remote code execution directly, any system with this package installed should be considered fully compromised.
The dzyclutch npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly subscribes the installer's WhatsApp account to author-controlled newsletter channels. This subscription occurs 30 seconds after connection and is hidden from the user by muting the channels. The list of subscribed channels is remotely controlled via a mutable GitHub raw URL, allowing dynamic changes without package updates. No credential theft, remote code execution, or data exfiltration outside WhatsApp is observed, but the installer's WhatsApp identity is misused to amplify the author's channel reach.
The npm package @diezyclutch/baileys contains malicious code or depends on a package with malicious code. Installing or running this package can lead to full compromise of the affected computer, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different machine is strongly advised. However, removal may not fully eliminate the threat due to potential persistent malicious software.
The npm package yonzoffic-baileys version 8.6.90 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. The malicious code uses the installer's authenticated WhatsApp session to issue a covert FOLLOW query to subscribe to hidden WhatsApp Channel/Newsletter JIDs. The target JIDs are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. This behavior does not steal credentials, establish persistence, or execute arbitrary code.
The bitcoin-rpc-lite RubyGem version 1.0.0 and 1.0.3 contains malicious code in its native extension build script extconf.rb. This script executes automatically during gem installation and, after evasion checks, opens a reverse shell to a hardcoded attacker IP address, allowing remote code execution. The malicious payload is concealed via Base64 encoding and delayed execution to evade detection in short-lived environments.
The RubyGems package 'web3-eth-utils' version 1.0.0 and 1.0.3 contains malicious code that executes during gem installation. The native extension script performs environment checks to evade sandbox and CI environments, then decodes and executes a Ruby payload that establishes a persistent reverse shell to a remote IP address. The package is a typosquat lure mimicking legitimate web3/eth ecosystem packages, with the actual malicious behavior hidden in the install-time hook.
The RubyGems package 'btc-wallet-tools' version 1.0.0 and 1.0.3 contains malicious code in its native extension script 'ext/req_throttle_mini/extconf.rb'. This script executes during gem installation and, after performing environment checks to evade analysis, decodes and runs a Base64-encoded Ruby payload that opens a reverse shell to a remote attacker. The reverse shell connects to IP 45.138.12.177 on TCP port 8090, providing the attacker with remote shell access to the host. The malicious behavior is concealed by delaying execution and checking for developer artifacts, making detection difficult during automated scans.
The RubyGems package 'wallet-crypto-utils' version 1.0.0 and 1.0.3 contains malicious code in its native extension script that executes during gem installation. The code performs environment checks to evade sandbox and CI environments, then decodes and executes a payload that opens a reverse shell to a remote IP address. This allows an attacker to gain interactive shell access to the developer's machine, potentially compromising sensitive credentials and developer artifacts.
The RubyGems package 'crypto-mnemonic-tools' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes during gem installation. The script performs environment checks to avoid CI and sandbox environments, then after a delay, opens a reverse shell to a remote IP address, providing an attacker interactive shell access on the victim's machine. The malicious behavior is hidden behind a decoy Ruby library and uses a double-forked daemon process to evade detection.