MAL-2026-18712

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/oktz-baileys/MAL-2026-18712.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18712

Published

2026-10-16T00:00:00Z

Modified

2026-11-05T23:15:04Z

Summary

Malicious code in oktz-baileys (npm)

Details

oktz-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own authenticated WhatsApp account to an author-chosen WhatsApp Channel. Part of the campaign OX Security documented as "PhantomSub" (2026-09-28): https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/ . Static read of the published 9.1.6 tarball on 2026-10-16 (not executed) found a hardcoded channel JID 120363400911374213@newsletter together with the newsletter FOLLOW query wired to run automatically after the socket connects, with errors suppressed. Same family as the withdrawn MAL-2026-4519 (chromestaff-baileys 1.1.3). Live on npm with no OSV record as of 2026-10-16.

References

Credits

- OX Security - FINDER
- - https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/
- Patrick Duggan, DugganUSA - REPORTER
- - mailto:patrick@dugganusa.com

Affected packages

npm / oktz-baileys

Package

Name: oktz-baileys; View open source insights on deps.dev
Purl: pkg:npm/oktz-baileys

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/oktz-baileys/MAL-2026-18712.json"