MAL-2026-16058

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vinzz-wcli/MAL-2026-16058.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16058
Published
2026-09-08T23:56:41Z
Modified
2026-09-09T01:00:04Z
Summary
Malicious code in vinzz-wcli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10)

vinzz-wcli is a WhatsApp CLI whose main entry (index.js) sets global.ownerr = "6285185667890@s.whatsapp.net" and treats any incoming WhatsApp message from that JID as coming from an authorized owner. The messages.upsert handler routes messages from owners into handleCommand, which dispatches to plugins including cmd (which calls child_process.exec on the message text) and eval (which builds and runs an AsyncFunction from the message text). When an installer runs the CLI and pairs their own WhatsApp account, the hardcoded third-party number is silently added as an owner and can send arbitrary shell commands and JavaScript to be executed on the installer's host with the installer's privileges. The tarball also ships a second file, index2.js, which is not the declared main but contains the same hardcoded owner JID and the same messages.upsert -> handleCommand dispatch, providing an equivalent execution path if that file is invoked directly.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019724",
            "import_time": "2026-09-09T00:47:57.755040675Z",
            "modified_time": "2026-09-08T23:56:41Z",
            "sha256": "8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / vinzz-wcli

Package

Name
vinzz-wcli
View open source insights on deps.dev
Purl
pkg:npm/vinzz-wcli

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "8ce360628b487353242c053bc03cde54f3f43cf59d0977ef9545fbade9ffdfce",
            "tlsh": "5c3354561cf6142411a3e07e6feb7012e225a0033908ee19bf9c93910fe9764d6ee7ed"
        },
        {
            "path": "index2.js",
            "sha256": "aae2f7aa8ccab6a296df083ca99de44df0bf0a750a66e1ffdbe6b296d9d06f48",
            "tlsh": "69833f450cfa183421a7e07e6feb7052e220a5136504ee1d7f8c83a50fe9764d6ae7ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "vinzz-wcli-1.0.1.tgz",
            "hashes": {
                "sha1": "3a400cbde472cd3f5da99703023770e7567c886f",
                "sha512_sri": "sha512-4jbKQQx7qFiej2XytsSy6XJ4y7QnzPfZVULeTBUwtSzuD+D08MU87G/klJZN7Od9eE8Qx5Xjd2ksZzWy9Zylsw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vinzz-wcli/MAL-2026-16058.json"