The @teamolduser/baileys npm package contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, establish persistence, or execute arbitrary code.
The npm package 'anuaja' versions 1.0.0, 1.1.0, and 1.1.1 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The eliteprotech-baileys npm package versions 1.1.0, 1.1.1, and 1.1.2 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The focashi npm package version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious subscription targets are obfuscated or dynamically fetched, and the attack leverages the victim's own WhatsApp session. The code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The ishumdz-bail npm package is part of a large family of near-identical forks of the Baileys WhatsApp Web library that inject malicious code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The kasabaileys npm package is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. It uses the victim's authenticated WhatsApp session to issue a covert FOLLOW query to subscribe to these channels. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not steal credentials, maintain persistence, or execute arbitrary code. Affected versions include 0.3.15, 1.0.0, 1.0.1, and 1.0.2.
The keithbaileys npm package versions 1.0.8, 1.1.0, and 1.1.1 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket layer using the installer's authenticated session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package lilys-baileys (versions 1.3.2 and 1.3.3) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious code uses obfuscation techniques to hide the target channel identifiers and may fetch dynamic target lists from remote hosts. The attack leverages the installer's own authenticated WhatsApp session but does not steal credentials, maintain persistence, or execute arbitrary code.
The noverojs npm package versions 1.0.1 and 1.0.4 contain malicious code that silently subscribes a victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The noxxleys npm package, part of a large family of Baileys WhatsApp Web library forks, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, which issues an authenticated FOLLOW query using the installer's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The spencer-baileys npm package version 1.0.4 is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the user's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The target channel identifiers are obfuscated or fetched remotely to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package syncxbails (versions 1.0.0 and 1.0.1) is part of a family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The whalibmob npm package contains malicious code that silently subscribes the installer's authenticated WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing authenticated FOLLOW queries to attacker-chosen WhatsApp Channel/Newsletter JIDs. The targeted JIDs are obfuscated or dynamically fetched to evade detection. The malicious behavior does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The xvinleys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. It achieves this by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The npm package xzvbails (version 0.0.1) is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel JIDs are obfuscated or fetched remotely, allowing dynamic control by the attacker. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code beyond this subscription action.
The npm package yonzofficial (versions 2.1.0 through 2.1.3) is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
A China-nexus threat cluster designated UAT-11587 has been targeting government and policy organizations across eight Asian countries since September 2025, delivering a previously undocumented Rust-compiled backdoor called Antino. The campaign primarily affected Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria through sophisticated spear-phishing operations using tailored political and diplomatic lures. The multi-stage infection chain leverages Cloudflare infrastructure for delivery and deploys Antino, which uniquely uses Microsoft 365 services—specifically Outlook and OneDrive—as dead-drop command-and-control channels rather than traditional C2 servers. The backdoor supports reconnaissance, command execution, file transfer, shellcode loading, and persistence establishment. Attribution to Chinese nexus is based on metadata containing Simplified Chinese artifacts, UTC+8 timestamps, use of China-focused Rust package mirrors, and targeting patterns consistent with Chinese intellige...
The friendly-greeting-tools package on PyPI, versions 0.1.0 through 0.3.7, contains malicious code disguised as a hello-world demo. It exfiltrates Snowflake session tokens, connection configurations, dbt profiles, and pip configurations by encrypting and storing them in a workspace directory. Additionally, it uses stolen credentials with high privileges to copy sensitive data from a Snowflake warehouse table to an attacker-controlled AWS S3 bucket. The package employs obfuscation techniques and includes misleading documentation to conceal its hostile intent.
The npm package com.epi.e2e_test version 1.2.2 contains malicious code that executes automatically during installation. A preinstall script runs an index.js file which collects host-specific identifiers such as the home directory, hostname, username, DNS servers, current working directory, and the package.json contents. This data is then sent via HTTPS to a hardcoded external server (meta.brs.cx) without user consent. This behavior is indicative of reconnaissance activity commonly associated with dependency confusion or internal name attacks.
The Python package beautifytext version 1.0.3 (and also 1.0.4 and 1.0.7) contains a malicious backdoor. Upon import or installation, it spawns a detached background process that registers the host with a remote command and control (C2) server and polls it for commands. This backdoor can execute arbitrary shell commands, read and write files on the infected host, and exfiltrate results to the attacker-controlled server. The malicious behavior activates both on import and during package installation, making it stealthy and persistent.
