{"id":"MAL-2026-18988","summary":"Malicious code in malvin-baileys (npm)","details":"malvin-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363391079867105@newsletter, 120363399205146445@newsletter and a list downloaded at runtime from https://cdn.malvintech.sbs/file/chJids.json (the URL itself stored as base64 strings), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","modified":"2026-11-09T23:15:32.305219140Z","published":"2026-10-27T00:00:00Z","database_specific":{"iocs":{"urls":["https://cdn.malvintech.sbs/file/chJids.json"],"domains":["cdn.malvintech.sbs"],"files":[{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"7921ff0f4dbe4177589dca05821305794409a5275a6d6d9702392810d55945b6"}},{"digests":{"sha256":"a36d842ed4b1fe2b9e99c9fe1f121455115749700fe21e968a4f85c650b687f9"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"ef66ddfca95960783e5dc5e2196e6146bfa5aca764d00586ccf0ea6dc5a8a8c7"},"paths":["lib/Socket/newsletter.js"]}],"ips":[]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/malvin-baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"malvin-baileys","ecosystem":"npm","purl":"pkg:npm/malvin-baileys"},"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/malvin-baileys/MAL-2026-18988.json"}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}