{"id":"MAL-2026-18678","summary":"Malicious code in @lekzox/baileys (npm)","details":"@lekzox/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Signal/Group/Protocols.js, lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363411018551754@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","modified":"2026-11-05T05:15:03.460166111Z","published":"2026-10-26T00:00:00Z","database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"f49b18df9a366a4f2a1515a1c9ba1a626a4c5757de8812cf4d3729067e178441"},"paths":["lib/Signal/Group/Protocols.js"]},{"digests":{"sha256":"f62cba1cf488355b1b42a1da7e530c730d5c98c002cb0fc8411d4b3c7e917100"},"paths":["lib/Socket/newsletter.js"]}],"ips":[],"urls":[]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@lekzox/baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"@lekzox/baileys","ecosystem":"npm","purl":"pkg:npm/%40lekzox/baileys"},"versions":["0.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lekzox/baileys/MAL-2026-18678.json"}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}