239514 matches found
MAL-2026-17443 Malicious code in @zanta/baileys (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
MAL-2026-17846 Malicious code in @yudzxml/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96357918fec8e046fe049ec94c614ab988e412532ace70beeb64d737533c3a30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17843 Malicious code in @xrelly-stack/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50a8bf97baef2afe279a36ada416d0c235247d68c31748c360ca9bf863cdbe49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17845 Malicious code in node-telegram-sockets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaa0928c7e6cf97f1059c7c8ec8ea2c1ffe53c127480bfe8f5081b489676d26d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17841 Malicious code in @wanzxlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05fbc39cd82cca7d65bc1220f85315d4ad6584a5f28a9ddb0e38744dbbd9c644 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17840 Malicious code in @wanzlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b1103787a1c723a0e4102acd15834c5420336480aec1e6dc37ba741937f735a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17381 Malicious code in @wanzlonely/bails4u (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17844 Malicious code in bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a36c9cf3f28683672c6c3bc2ba38d881dec1c6bd97e72e2bf13e29ee76604389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17839 Malicious code in @wanzlonely/bailsme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f3eccacfdf2ece39dce55b7c1ba8330f39be88659053a43713fb16e39b6e2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17838 Malicious code in @wanzlonely/bailsforme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d20a942a9977d81d31c2c6e2107befe05ef40ea0f60363afb3132b03eb29d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17382 Malicious code in @wenzyx1/bails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17837 Malicious code in @sanzoffc/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2838d53888242c50e19ce80fc949f25a34de59a1282fc3631abf64a671e7afe9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17379 Malicious code in @sakataoffc/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17378 Malicious code in @sairidev/baileys-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17836 Malicious code in @saazkira/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02ddff50116449dec10c106e58ae0c84f16919145b8e13ddea1a23b0f00e9c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17835 Malicious code in @saazkira/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716e747d34d02e4d4b2d34558753e65ce26a72e086b5c2388427d22eb2b0e969 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17377 Malicious code in @saazkira/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17825 Malicious code in @revizahoshii/hoshino-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9672a5dc6f8c45d8f76743e019edc248d1ba5523560bbe6e2a8185bac64b668c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17834 Malicious code in @revizahoshii/hoshino-wam (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ae1d092716881cb0e1374342f7fe125511d3a712d0fb5a171ea4e859650dc90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17827 Malicious code in @revizahoshii/hoshino-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e78d94690ef4e2d415c7754cf5e87fa9585670df0485bfd467a58e71a8afa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17833 Malicious code in @revizahoshii/hoshino-voip (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 505d5a8535239db195966648019eb5584f9add49d96347a260c4d184c81e08ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17824 Malicious code in @revizahoshii/hoshino-fake-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bda9c3c386df18faa88110fc1cb8aa61654547c70ea0b3e970735dd69f247f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17826 Malicious code in @revizahoshii/hoshino-media-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17830 Malicious code in @revizahoshii/hoshino-store-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413598986f6891c8b092769e99f8995809b19b477eb3dff36899d857aec516ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17831 Malicious code in @revizahoshii/hoshino-store-redis (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 479c2ff94e78f7493a07e739eb36adc5eba6c31d7e2846a3ecea52d04dd3aa9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17832 Malicious code in @revizahoshii/hoshino-store-sqlite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5be1bfeb40b1b25c136a73036ef88cd35ed77e2662ca3e69235b4c3b081ff9cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17829 Malicious code in @revizahoshii/hoshino-store-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b408e63765025424d6570c3bd05bd6e01534734e6613fabee59696d11d1f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17828 Malicious code in @revizahoshii/hoshino-store-mongo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbbe1a1b8523eee7d05bc6e5c5dfa9e65fd25e1c42b9fed34f645048dba47b6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17376 Malicious code in @revizahoshii/hoshino (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17375 Malicious code in @revizahoshii/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17388 Malicious code in baileys-xbats (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17818 Malicious code in @alipclutch/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17352 Malicious code in @fhkryxv/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17353 Malicious code in @fhkryxv/baileys-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17821 Malicious code in @fazzcodestudio/fbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02d04f078ee45b434a2f48ebecea2fc18811a6830ab2e24baccea6e577baa0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17842 Malicious code in @we3js/framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b363085b57cf1cfd50b00e3845bdd50122e4e2f137a124def03f5cf59e7b23b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17820 Malicious code in @fazzcodestudio/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d9a7ab4b8ee5eb018dda5e7d3b273e9bc690364e24d4ece93d1107cfa791d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17441 Malicious code in @fazzcodestudio/wa-web (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
MAL-2026-17822 Malicious code in @fazzcodestudio/mediaformater (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2777e6e1aff40e693fdc759b07014c5ad7c6b24fbd40d3b3cdb8d2f32c6249ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17819 Malicious code in @badzz88/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eafa4b306df1ba72117512af8f1b676cd101c93bac67d887418f318b39efcc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17340 Malicious code in @astracode/byles-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17823 Malicious code in @modss/libsignal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78daaf334cc6740c70b214309f4bf742a863b8c3c421076490cdb84790dd9550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17368 Malicious code in @mivesensei/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17814 Malicious code in @mikudeveloper/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4749ec89d8c51729fbd97994a6a035ab229a56bb1094c4c47d9a3d68df050711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17367 Malicious code in @mikudeveloper/grace (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17815 Malicious code in amprem (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a1fce1d60e5a65e3872606d1167bd97dde29477b3d541736a537955c7dfe132 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17813 Malicious code in @lekzo_dev/amprem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link'...
MAL-2026-17361 Malicious code in @kanaraa/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17360 Malicious code in @jojoxyz/condemnedforce-baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17816 Malicious code in ikanngeming (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 966642a4fb31fee9c17517bf5b81d34a3d86345ee225b4dfc07f33bdd6636112 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...