MAL-2026-18934

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amiudmodz/MAL-2026-18934.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18934
Published
2026-10-27T00:00:00Z
Modified
2026-11-09T23:15:16Z
Summary
Malicious code in amiudmodz (npm)
Details

amiudmodz is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363400725985615@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).

Database specific 
{
    "iocs": {
        "domains": [],
        "files": [
            {
                "digests": {
                    "sha256": "20431e4f6978abaca573463e0c10d251d468a5a0598ea98c991515e50f790d5b"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "466e650955a82114f66d6fd064a3a429afd54b859c2fdcbfe27b9b4d8d53a8ea"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "6251a07f77cd904755488579af9c070204b699895cb48c6fc7238bd0b6a0f3af"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "8dbe2e86d7ff6b02bc8a694a3a415cb424e3c5916a19045f70766ae51b6a54d7"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "a1ae864f459f9dd3142799c653a16f27c9632d8660a13f5947185a91c1f06cb6"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "b6550abf492b60bb1ceb16d44a318f16591825ed3d4dbf5b76e40d92254fd690"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "e1a832211a3e5a98043bd13246643d50eb58630a29d42e3c4cdf1b05018fdbac"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            },
            {
                "digests": {
                    "sha256": "f6f077f0bbdadd172c42e75efe8ccf45c466821a2059a84566638f0209644983"
                },
                "paths": [
                    "lib/Socket/newsletter.js"
                ]
            }
        ],
        "ips": [],
        "urls": []
    }
}
References
Credits

Affected packages

npm / amiudmodz

Package

Name
amiudmodz
View open source insights on deps.dev
Purl
pkg:npm/amiudmodz

Affected ranges

Affected versions

4.*
4.0.6
4.1.2
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.5
5.1.6
5.2.0
5.2.1
6.*
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.2.5
6.2.6
6.2.7
6.2.9
6.3.0
6.3.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amiudmodz/MAL-2026-18934.json"