{"id":"MAL-2026-18859","summary":"Malicious code in @kyuu2nd/baileys (npm)","details":"@kyuu2nd/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363330344810280@newsletter, 120363400738305381@newsletter, 120363402868866359@newsletter, 120363404790454890@newsletter, 120363404861802607@newsletter, 120363405313529091@newsletter and 13 more (stored as character-code arrays) and a list downloaded at runtime from https://raw.githubusercontent.com/kiuur/IDCH/refs/heads/main/idch.json, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","modified":"2026-11-09T23:15:23.341528925Z","published":"2026-10-27T00:00:00Z","database_specific":{"iocs":{"ips":[],"urls":["https://raw.githubusercontent.com/kiuur/IDCH/refs/heads/main/idch.json"],"domains":["raw.githubusercontent.com"],"files":[{"digests":{"sha256":"13baa4c5b9890f3c4341e7fee686f782d4015f0694397584335756577466237e"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"5551faccbf72ce892ef0c6f4097dd924b50602f04cf84196bb82b9012f8d4a25"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"5ff2ab25ea9c2d5c5682f81291c7858bc5c9d326d19f666e8ad4d50c2a588b43"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"714ef6af60d657271a50c21fbcfdbc4232af5fde4410bc94e369132a19fb6e7a"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"735ee38570cdd0496884b2e2fb79de0bae49102f26b1172175bcaf79a0ac1aab"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"76f436b74bdb6bdf14bf60acbaf5ccfd43b90b9f76b9c7d5de60a85e8bd2b07d"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"825508780335a6880fda8da07b0e443fc92c7a4ecbec4ed869d8d84fb8e86572"},"paths":["lib/Socket/newsletter.js"]},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"8f77c299c3e1de2d0424174d71492d1b6fa0fa7b45c9271dc3668518e59c1fc8"}},{"digests":{"sha256":"99ca6c31a5097cc519f8fb23a2985dd96a0ac8ea84239ccba54a3cf313012bd6"},"paths":["lib/Socket/newsletter.js"]},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"d38e80cb9afa591f4b6b560c71b2867488a7138da65c6957e03a0669b9da3757"}},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"d7ae2ae9c2b9197709ca28e45a6968abe81361d70e08edea0e53c26d69cffecd"}},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"e379a09e0e315bbd3d3b739af25c9e76fe7cbf14861f8c007b0d6bc987336817"}},{"digests":{"sha256":"fad2d892611c62196223eefc5bc54030c0fe7d251276c035277b0a126971a810"},"paths":["lib/Socket/newsletter.js"]}]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@kyuu2nd/baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"@kyuu2nd/baileys","ecosystem":"npm","purl":"pkg:npm/%40kyuu2nd/baileys"},"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.2","2.0.24","2.0.25","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@kyuu2nd/baileys/MAL-2026-18859.json"}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}