{"id":"MAL-2026-17408","kind":"package","aliases":["MAL-2026-17408"],"related":[],"title":"Malicious code in whalibmob (npm)","description":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: whalibmob (npm), version(s): 5.33.5, 5.33.4, 5.33.3, 5.33.2, 5.32.2, 5.32.1, 5.32.0, 5.30.0, 5.29.6, 5.29.5, 5.29.4, 5.29.3, 5.29.2, 5.29.1, 5.29.0, 5.28.0, 5.25.0, 5.24.2, 5.24.1, 5.24.0.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"whalibmob","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"withdrawn","published_at":"2026-09-30T09:57:36+00:00","first_seen_at":"2026-10-27T12:01:28+00:00","triaged_at":"2026-10-27T12:02:31+00:00","updated_at":"2026-10-27T12:02:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17408':8A,11A '-2026':7A,10A '100':23C '2026':28C '5.24.0':267C '5.24.1':266C '5.24.2':265C '5.25.0':264C '5.28.0':263C '5.29.0':262C '5.29.1':261C '5.29.2':260C '5.29.3':259C '5.29.4':258C '5.29.5':257C '5.29.6':256C '5.30.0':255C '5.32.0':254C '5.32.1':253C '5.32.2':252C '5.33.2':251C '5.33.3':250C '5.33.4':249C '5.33.5':248C '7871414976211147':67C 'abus':212C 'account':91C 'across':116C 'action':47C,211C 'affect':242C 'anoth':154C 'arbitrari':239C 'array':132C 'ask':96C 'attack':73C,143C,227C 'attacker-chosen':72C 'attacker-control':142C,226C 'authent':60C,83C,217C 'bailey':36C 'base64':123C,125C 'casual':106C 'chang':162C 'channel':45C,93C,229C 'channel-subscript':44C 'channel/newsletter':76C 'char':130C 'char-cod':129C 'chosen':74C 'code':2A,57C,131C,241C 'connect':54C,184C,194C 'control':144C,228C 'covert':43C 'credenti':234C 'differ':206C 'encod':124C 'establish':235C 'even':195C 'everi':170C 'execut':238C 'exfiltr':233C 'famili':22C,118C,174C 'fetch':139C 'fire':187C 'follow':63C,189C 'fork':33C,208C 'gain':221C 'github':152C 'hidden':104C 'host':155C 'id':66C 'ident':32C 'identifi':24C 'inject':41C,56C 'instal':80C,164C,214C 'instead':138C 'issu':58C 'jid':77C,101C,150C,200C 'join':98C 'json/js':146C 'larg':21C 'layer':52C 'let':158C 'librari':39C 'list':147C,161C 'liter':122C 'mal':6A,9A 'malici':1A,13B,210C 'mechan':179C 'method':205C 'mex':62C 'mutabl':141C 'name':199C 'near':31C 'near-ident':30C 'never':95C 'new':167C 'npm':5A,168C,245C 'obfusc':113C 'obfuscation/delivery':204C 'observ':115C 'one':69C,110C 'packag':14B,16C,198C,243C 'part':18C 'per':207C 'persist':236C 'plain':120C 'publish':169C 'queri':64C,65C,190C 'reach':222C 'reconstruct':133C 'remot':145C,240C 'review':108C 'routin':185C 'runtim':135C,157C 'sampl':171C 'second':192C 'septemb':27C 'session':85C,219C 'sever':112C 'share':175C 'silent':86C 'socket':51C,183C 'socket-connect':182C 'sourc':107C 'string':121C 'subscrib':87C,224C 'subscript':46C 'target':100C,149C,160C 'techniqu':114C 'though':196C 'under':178C 'use':78C 'valu':201C 'variant':137C 'version':246C 'via':109C 'victim':89C 'w':61C 'web':38C 'whalibmob':4A,12A,244C 'whatsapp':37C,50C,75C,84C,218C 'without':165C 'wrapped/patched':181C 'xor':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-30T09:57:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17408","url":"https://osv.dev/vulnerability/MAL-2026-17408","severity":"critical","published_at":"2026-09-30T09:57:36+00:00","modified_at":"2026-10-27T11:15:04+00:00","first_seen_at":"2026-10-27T12:01:28+00:00","fetched_at":"2026-10-27T12:01:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}