A cluster of 101 malicious npm packages has been used to add developers’ WhatsApp accounts to groups and channels without permission, according to a report by The Hacker News citing OX Security researchers. The packages, linked to a campaign called PhantomSub, were downloaded about 490,000 times, including 116,000 downloads in the previous 30 days.
A dependency becomes a distribution channel
The packages abuse Baileys, an open-source WhatsApp project used to connect software to WhatsApp accounts. The reported campaign targets developers who install modified Baileys forks, then uses their authenticated bot sessions to create unwanted subscriptions. Some variants also caused accounts to follow attacker-controlled channels or inserted an advertising URL into media sent by the bot, according to earlier findings cited in the report.
Three implementation patterns
OX Security identified three versions of the subscription mechanism across the packages. One group of 19 packages retrieved channel identifiers from GitHub when the code ran. Another 60 embedded the identifiers directly in source code, while 14 used encoded or obfuscated identifiers. The differing implementations were connected by repeated channel IDs, remote lists and GitHub accounts appearing across packages with different names and publishers.
The audience being collected
The researchers linked at least one targeted WhatsApp group to Indonesia. It promoted accounts and services related to mobile games and applications, including Mobile Legends: Bang Bang and TikTok. Other identified channels marketed bot scripts, bot-building services, premium APKs and social-media boosting. Reported follower counts ranged from hundreds to several thousand, serving as promotional proof for the channel operators.
What affected developers should check
Developers are advised to inspect their WhatsApp accounts for unexpected group or channel memberships and block unwanted additions. The report also recommends detection rules for the identified malicious Baileys packages and caution around packages that require a personal WhatsApp account to remain connected. The findings do not establish that every Baileys fork is malicious; they concern the package set attributed to the PhantomSub campaign.
AI-generated editorial illustration; not a documentary photograph.
Source: 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
SIGNAL TITANS
Leave a Reply