{"id":"MAL-2026-19018","summary":"Malicious code in skylerss (npm)","details":"skylerss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/chats.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363408224884979@newsletter, 120363426241392511@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","modified":"2026-11-09T23:15:36.762746702Z","published":"2026-10-27T00:00:00Z","database_specific":{"iocs":{"files":[{"digests":{"sha256":"07c074946bd96ed24b7aab8f4622bfa2d3f2bd0f2d5e612a9d06844a86d077de"},"paths":["lib/Socket/chats.js"]},{"digests":{"sha256":"67fd40fb68ac3a2a87ad1d079097d12f3c2b89cbc34fd76a9f0061894f5fc017"},"paths":["lib/Socket/chats.js"]},{"digests":{"sha256":"a14a5ab9e6604abf735e3dfb7d1c156d60b15249efc9d669c78f18b1cd029e38"},"paths":["lib/Socket/chats.js"]}],"ips":[],"urls":[],"domains":[]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/skylerss"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"skylerss","ecosystem":"npm","purl":"pkg:npm/skylerss"},"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/skylerss/MAL-2026-19018.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.2","credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}