MAL-2026-17451 Malicious code in wailib (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MSC-2026-6382

Trojanized fork of the Baileys WhatsApp library. lib/Socket/messages-recv.js:1313-1332 contains char-code-obfuscated String.fromCharCode WhatsApp newsletter JIDs 120363418691561888@newsletter, 120363420179178031@newsletter, 120363411139192580@newsletter which are silently followed and then muted...