101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
Summary: OX Security researchers identified 101 npm packages that abuse the Baileys WhatsApp open source project to add developers' WhatsApp accounts to groups without consent, in a campaign dubbed PhantomSub. The packages have been downloaded 490,000 times in total, including 116,000 in the last 30 days, and OX found three malware variants that differ in how they handle the subscription routine.
Key Takeaway: The same channel IDs, remote channel lists, and GitHub accounts recur across packages with different names and publishers, so a shared channel means a shared beneficiary collecting followers from every package that targets it. With 116,000 downloads in 30 days, the install base is still growing while the packages remain in circulation.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026