{"id":"MAL-2026-18934","summary":"Malicious code in amiudmodz (npm)","details":"amiudmodz is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363400725985615@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","modified":"2026-11-09T23:15:16.649293604Z","published":"2026-10-27T00:00:00Z","database_specific":{"iocs":{"urls":[],"domains":[],"files":[{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"20431e4f6978abaca573463e0c10d251d468a5a0598ea98c991515e50f790d5b"}},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"466e650955a82114f66d6fd064a3a429afd54b859c2fdcbfe27b9b4d8d53a8ea"}},{"digests":{"sha256":"6251a07f77cd904755488579af9c070204b699895cb48c6fc7238bd0b6a0f3af"},"paths":["lib/Socket/newsletter.js"]},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"8dbe2e86d7ff6b02bc8a694a3a415cb424e3c5916a19045f70766ae51b6a54d7"}},{"digests":{"sha256":"a1ae864f459f9dd3142799c653a16f27c9632d8660a13f5947185a91c1f06cb6"},"paths":["lib/Socket/newsletter.js"]},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"b6550abf492b60bb1ceb16d44a318f16591825ed3d4dbf5b76e40d92254fd690"}},{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"e1a832211a3e5a98043bd13246643d50eb58630a29d42e3c4cdf1b05018fdbac"}},{"digests":{"sha256":"f6f077f0bbdadd172c42e75efe8ccf45c466821a2059a84566638f0209644983"},"paths":["lib/Socket/newsletter.js"]}],"ips":[]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/amiudmodz"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"amiudmodz","ecosystem":"npm","purl":"pkg:npm/amiudmodz"},"versions":["4.0.6","4.1.2","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.7","5.0.8","5.0.9","5.1.0","5.1.1","5.1.2","5.1.5","5.1.6","5.2.0","5.2.1","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.1.6","6.1.7","6.2.5","6.2.6","6.2.7","6.2.9","6.3.0","6.3.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/amiudmodz/MAL-2026-18934.json"}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}