{"id":"MAL-2026-18981","summary":"Malicious code in itssofc (npm)","details":"itssofc is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js, lib/autofollow-newsletters.js sends the WhatsApp w:mex FOLLOW query and then MUTE, so the channel goes unnoticed, for a list downloaded at runtime from https://raw.githubusercontent.com/kyizz-hue/baileys-corp/refs/heads/main/news.json, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","modified":"2026-11-09T23:15:31.649302475Z","published":"2026-10-27T00:00:00Z","database_specific":{"iocs":{"domains":["raw.githubusercontent.com"],"files":[{"digests":{"sha256":"f9f5b17dde440490f48491177717353d1a26d231cfaf2afd10ab3d762dabb8c7"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"28c5fd6c37906392a810f3f204bec6be8ae7773422a3eb5a39a6b9afe14ca97c"},"paths":["lib/autofollow-newsletters.js"]}],"ips":[],"urls":["https://raw.githubusercontent.com/kyizz-hue/baileys-corp/refs/heads/main/news.json"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/itssofc"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"itssofc","ecosystem":"npm","purl":"pkg:npm/itssofc"},"versions":["1.2.13"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/itssofc/MAL-2026-18981.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}