{"id":"MAL-2026-4619","summary":"Malicious code in naileys (npm)","details":"naileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363392840803980@newsletter, 120363406068468165@newsletter, 120363407185712919@newsletter, 120363420514587725@newsletter, 120363426706961217@newsletter, using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53307e8df479525765ddef8cf9a54dcf0aa368b8ef57a088b624a5e80f72c999)\nnaileys is a fork/lookalike of the WhatsApp library baileys (single-character edit; internal references still mention 'wileys', and fetchLatestBaileysVersion in lib/Utils/generics.js queries https://registry.npmjs.org/wileys). On every successful WhatsApp connection, lib/Socket/newsletter.js (lines 83-99) executes a hardcoded auto-follow routine: a comment 'Naileys - Auto follow channels on connect' precedes a CHANNELS array containing three hardcoded JIDs ('120363426706961217@newsletter', '120363406068468165@newsletter', '120363420514587725@newsletter') and issues newsletterWMexQuery(jid, QueryIds.FOLLOW) for each. This fires automatically when a consumer simply uses the advertised makeWASocket API — no opt-in, no documentation, no configuration. The effect is that every WhatsApp account driven by naileys (the developer's account or any bot/end-user account using their software) is silently subscribed to author-controlled newsletter channels, modifying installer-side account state and giving the author guaranteed broadcast reach to every consumer. This is the silent-relay pattern: the package's documented API has an undisclosed side effect routed to a hardcoded author destination. The name-similarity to baileys plus verbatim API mimicry corroborates intentional typosquat-as-delivery-vehicle.\n","modified":"2026-11-09T23:15:34.607249303Z","published":"2026-05-20T12:27:33Z","withdrawn":"2026-05-26T22:13:04Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-20T12:27:33Z","sha256":"53307e8df479525765ddef8cf9a54dcf0aa368b8ef57a088b624a5e80f72c999","source":"amazon-inspector","versions":["0.5.2"],"id":"IN-MAL-2026-003527","import_time":"2026-05-26T05:50:47.804321042Z"}],"iocs":{"urls":[],"domains":[],"files":[{"paths":["lib/Socket/newsletter.js"],"digests":{"sha256":"8c88b23b622bbb3db53de8b9800e71c1ae1b3cff92557d4c0b02b041fca00e0e"}},{"digests":{"sha256":"91c7c8db421bd3b4ca283949ac25ead08095bf958f6b85ddc65ef13a34a4c6b4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"a51334b333e25bd42e3a9f2bf7c9153044cd6e28a74be30298ab45a04776161c"},"paths":["lib/Socket/newsletter.js"]}],"ips":[]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/naileys/v/0.5.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/naileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"affected":[{"package":{"name":"naileys","ecosystem":"npm","purl":"pkg:npm/naileys"},"versions":["0.5.2","0.5.1","0.5.4","0.5.6"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"lib/Socket/newsletter.js","sha256":"a51334b333e25bd42e3a9f2bf7c9153044cd6e28a74be30298ab45a04776161c","tlsh":"1842425a55ba5b6506b37454967ff0e1b321b303396698633f8c94020f0b1dda8f3bda"},{"sha256":"9d8b05fb9f7aae77284167b0a457521501fc7eea4cad3ddf6d77542a76be4111","tlsh":"72822bc99ff355760793a199ab2be0067b3a88133159c4f8ba1c83605f410a4cbda7e9","path":"lib/Utils/generics.js"}],"package_integrity":[{"filename":"naileys-0.5.2.tgz","hashes":{"sha512_sri":"sha512-N9uShe2QT+97wbpJWi5tkuwoZ2KtE0gexAR3vVUoJ6r53/Nk2bt7zwzGdseRieqOtnAW6pmPXqjTUYDEu893ew==","sha1":"8c51beba4ef2cc088314eff9024ac407e22ff310"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/naileys/MAL-2026-4619.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]}