Loading story…
Researchers identified PhantomSub, a coordinated npm supply-chain campaign in which 101 malicious packages abuse forks of Baileys, an unofficial WhatsApp API library. When developers authenticate WhatsApp through affected packages, the code silently subscribes their accounts to attacker-controlled groups or channels, sometimes muting them to avoid detection. The packages have accumulated about 490,000 downloads, including 116,000 in the prior 30 days, and many remained available as of September 28.
The packages retrieve target channel identifiers from GitHub-hosted lists or conceal them as plaintext, Base64-encoded, or otherwise obfuscated values. The operation appears designed to manufacture follower counts and social proof for channels promoting bot scripts, premium APKs, gaming resources, social-media boosting, and account sales, largely within an Indonesian-focused ecosystem. Shared channel IDs, GitHub infrastructure, and nearly identical package names indicate coordinated or overlapping operators; removals have not ended the threat because new variants continue to be published.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Xygeni Security Research Team disclosed that @dappaoffc/baileys-mod subscribed an authenticated WhatsApp bot session to attacker-controlled newsletter channels.
SafeDep reported that malicious npm forks of the Baileys WhatsApp library caused installers' WhatsApp accounts to follow attacker-controlled channels. It also found some forks inserted an author's advertising URL into bot-sent images and videos.
Researchers identified PhantomSub, a coordinated campaign comprising 101 malicious npm packages derived from or associated with the Baileys ecosystem. The packages silently add authenticated victim WhatsApp accounts to attacker-controlled groups or channels, with shared identifiers and infrastructure indicating overlapping operators or beneficiaries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious package named `lotusbail` was discovered on the npm registry, masquerading as a legitimate WhatsApp Web API library. The package, a fork of the popular WhiskeySockets Baileys project, provides full WhatsApp API functionality while secretly stealing authentication tokens, session keys, messages, contact lists, media files, and documents from users. Researchers at Koi Security found that the package uses a malicious WebSocket wrapper to intercept all data passing through, encrypts the stolen information using multiple obfuscation techniques, and exfiltrates it to attacker-controlled servers. In addition to data theft, `lotusbail` implements a covert device pairing process, linking the attacker's device to the victim's WhatsApp account and granting persistent access even after the malicious package is removed. The package has been available on npm for at least six months, accumulating over 56,000 downloads, and employs advanced anti-analysis techniques such as infinite loop traps to evade detection. Victims must manually remove unauthorized devices from their WhatsApp settings to revoke attacker access.
Jun 29, 2026
Researchers reported a renewed **PhantomRaven** software supply chain campaign on the npm registry involving **88 malicious packages** masquerading as trusted JavaScript ecosystem projects, including packages themed around *Babel* and *GraphQL Codegen*. The packages were published across three waves from late 2025 into early 2026 and were designed to automatically fetch and run malware after installation, targeting developers and build environments rather than end users. The activity is not fluff: it is a substantive threat intelligence and malware distribution story involving active credential theft through open-source package abuse. The malware exfiltrates sensitive data from developer systems and CI/CD environments, including emails and configuration data from `.npmrc`, `.gitconfig`, and environment variables, as well as tokens for **GitHub**, **GitLab**, **CircleCI**, and **Jenkins**. Reporting indicates PhantomRaven has kept core infrastructure and payload behavior broadly consistent since earlier activity, while adapting operational details by rotating npm and email accounts, changing package metadata and PHP endpoints, and increasing the pace of malicious package publication. Most of the packages were reportedly still available for download at the time of reporting, underscoring continued exposure for organizations that rely on npm-based development workflows.
Jun 29, 2026
A large-scale attack on the NPM (Node Package Manager) ecosystem has been uncovered, involving the publication of over 64,000 malicious packages by a coordinated group known as the IndonesianFoods worm. This campaign, active for more than two years, leveraged at least seven newly created NPM user accounts to distribute the malicious packages, which are notable for their consistent naming patterns and unusual internal dictionary. The attackers focused on creating new packages rather than stealing credentials, and the scale of the operation more than doubles the previously known number of malicious NPM packages. Security researchers have made available a comprehensive list of the affected packages and user accounts for further analysis. In a separate but related incident, researchers identified a highly popular fake NPM package, "@acitons/artifact," which was downloaded over 206,000 times. This package used a typosquatting technique to mimic the legitimate GitHub Actions Toolkit and was designed to steal GitHub credentials by executing a malicious post-install script. The attack highlights the growing threat of software supply chain compromises, with the malicious package aiming to exfiltrate tokens from build environments and potentially publish further malicious artifacts. Both incidents underscore the increasing sophistication and scale of supply chain attacks targeting the JavaScript development community.
Jun 29, 2026