Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17405 Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2019-11932-SupportApp

CVE-2019-11932-SupportApp يهدف ملف الشيفرة الأصلية هذا إلى أن يكون مكملاً لاستغلال ثغرة RCE في WhatsApp عبر GIF الذي نشره Awakened، من خلال حساب عنوان دالة system وعنوان ROP gadget لأنواع مختلفة من الأجهزة، والتي يمكن استخدامها بعد ذلك لاستغلال الثغرة بنجاح...

CVE-2019-11932

CVE-2019-11932 يجب استبدال عنوان الدالة system و الـ gadget بالعنوان الفعلي الذي تم العثور عليه من خلال ثغرة كشف المعلومات. بعد استبدال عنوان system و الـ gadget. قم بتشغيل الكود لإنشاء ملف GIF التالف: notroot@osboxes:/Desktop/gif$ make ..... ..... ..... notroot@osboxes:/Desktop/gif$ ./exploit...

CVE-2019-11933

CVE-2019-11933 فساد الكومة Heap corruption في منتقي الوسائط في واتساب يؤثر على واتساب للأندرويد قبل الإصدار 2.19.291 الخلفية يتم تقسيم ملف GIF إلى أجزاء، يتم تمييز كل جزء ببايت محدد: الصورة 0x2C يصف قسم الصورة إطارًا واحدًا في ملف GIF، ويحتوي على معلومات مثل الارتفاع والعرض، بالإضافة إلى الصورة...

MAL-2026-17450 Malicious code in rubbydev-crash-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17445 Malicious code in ichigo-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17442 Malicious code in @smart-dev-wa/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17440 Malicious code in @erlanzz/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17452 Malicious code in xcvrenzcompany (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17448 Malicious code in prastzy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17444 Malicious code in danz-bails (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17449 Malicious code in prastzyy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17451 Malicious code in wailib (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17438 Malicious code in @celestial-community/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17446 Malicious code in luoxy-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17447 Malicious code in mikuhostt-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17443 Malicious code in @zanta/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17439 Malicious code in @developmentyora/baileyss (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17441 Malicious code in @fazzcodestudio/wa-web (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...