The whalibmob npm package contains malicious code that silently subscribes the installer's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs. The targeted JIDs are obfuscated or dynamically fetched to evade detection. The malicious behavior does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The xvinleys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. It achieves this by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The npm package xzvbails (version 0.0.1) is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel JIDs are obfuscated or fetched remotely, allowing dynamic control by the attacker. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code beyond this subscription action.
The npm package yonzofficial (versions 2.1.0 through 2.1.3) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.
The npm package 'reactjs-risk' versions 99.17.1 and 99.17.2 contains malicious code that executes during installation. Its preinstall script collects host identity metadata including hostname, username, and platform, encodes this data, and sends it via DNS lookup to a third-party domain without user consent. The package's main entry point is a non-functional stub, indicating the sole purpose is to exfiltrate installer information. This behavior is deliberately obfuscated to evade detection.
The npm package '@cat-gen/materia' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone does not guarantee the elimination of all malicious software introduced by its installation.
The npm package '@cat-gen/material' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee eradication of all malicious software introduced by its installation.
The npm package '@firelordzuka/pulse-poc' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is advised, but due to the potential for persistent malicious software, complete remediation may require additional measures. All secrets and keys stored on the compromised system should be rotated from a separate, secure device.
The npm package 'link-status-page' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package 'link-age-great' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee the removal of all malicious software or backdoors introduced by this package.
The npm package '@redman89405/my-module' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone may not eliminate all malicious software introduced by the package, as full control of the system may have been granted to an attacker.
The npm package 'runhelper' version 1.0.0 contains malicious code that, upon being required, loads and executes a native payload disguised as a .jpg file. This payload is staged by its dependency 'imgbundle' and executed in-memory on Windows systems using kernel32 API calls via the 'koffi' FFI. The payload file is deleted after execution, and the module suppresses all errors, hiding its true behavior. The advertised functionality is a cover story; the actual behavior is the execution of attacker-supplied native code in-process.
The npm package 'iban-validator-js' contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone may not eliminate all malicious software introduced by its installation.
The npm package 'focaleys' version 1.1.0 declares a dependency on 'libsignal' via a GitHub repository reference without specifying a fixed tag, version, or commit SHA. This means that on installation, the dependency resolves to the current default branch HEAD of the repository, executing any lifecycle scripts present there on the installer's machine. Control of the GitHub account 'rexxzyid' thus allows an attacker to run arbitrary code during installation of 'focaleys', potentially changing silently between installs without modifying the 'focaleys' package itself.
The npm package 'fca-raihan' versions 37.2.5 and 37.2.6 declare a dependency on themselves via an off-registry GitHub source without a pinned reference or integrity check. This allows the repository owner to change the installed code at any time, potentially introducing malicious code during installation. The package includes base64 decoding and references consistent with its advertised messaging and end-to-end encryption functionality, but these are not independently verifiable without examining the mutable GitHub source at install time.
The npm package exiouss version 5.0.1 contains malicious code that imports the child_process module and sends POST requests to hardcoded endpoints, including a public Google domain and a non-resolvable internal domain likely used for attacker command and control. The code also repeatedly invokes ping commands, indicating potential active data exfiltration or reconnaissance behavior. This activity is inconsistent with normal HTTP client operations and suggests the package has been compromised to perform unauthorized network communication.
The npm package 'imgbundle' versions 1.0.0 and 1.0.1 contains malicious code that does not perform its advertised image bundling function. Instead, it decrypts an AES-256-CBC encrypted file from a sibling dependency 'cdn-img-fetch' using a hardcoded key, writes the decrypted content to disk, deletes the original encrypted file, and sets up a file watcher to repeat this process if the encrypted file reappears. This behavior effectively makes 'imgbundle' a staged dropper that materializes attacker-controlled content on the filesystem at import time, contrary to its stated purpose.
The contoso-login-sim-loader npm package contains a malicious payload concealed as an RC4-encrypted base64 blob that decrypts and executes in the browser at runtime. It employs anti-analysis techniques such as detecting developer tools and disabling console logging to evade detection. The package lacks source code, dependencies, or documentation, and its deceptive naming and description suggest it may serve as a fake login or credential-harvesting overlay when included in websites. This behavior poses a risk of embedding attacker-controlled JavaScript into affected sites, potentially compromising end users.
The npm package cdn-img-fetch versions 1.0.0 and 1.0.1 unconditionally downloads a file from a mutable third-party GitHub repository at module load time and writes it to a hidden temporary file on the installer's system. This behavior occurs automatically upon import without user interaction and does not verify the source content's integrity. The package's advertised functionality does not justify this import-time network fetch and hidden file write, indicating malicious intent as a first-stage dropper mechanism.