{"id":"MAL-2026-18710","kind":"package","aliases":["MAL-2026-18710"],"related":[],"title":"Malicious code in kurobails (npm)","description":"kurobails is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own authenticated WhatsApp account to an author-chosen WhatsApp Channel. Part of the campaign OX Security documented as \"PhantomSub\" (2026-09-28): https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/ . Static read of the published 2.0.3 tarball on 2026-10-16 (not executed) found four channel JIDs (120363409616710069, 120363424058761303, 120363424944937940, 120363429340573125, @newsletter) decoded at runtime from base64 or char-code arrays, together with the newsletter FOLLOW query wired to run automatically after the socket connects, with errors suppressed. Same family as the withdrawn MAL-2026-4519 (chromestaff-baileys 1.1.3). Live on npm with no OSV record as of 2026-10-16. (Corrected 2026-10-16: an earlier version of this entry cited 120363421563597486, which in this package only labels forwarded messages.)","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kurobails","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:28+00:00","updated_at":"2026-11-05T23:49:28+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':52C '-10':66C,128C,132C '-16':67C,129C,133C '-18710':8A,11A '-2026':7A,10A,112C '-28':53C '-4519':113C '/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/':56C '1.1.3':117C '120363409616710069':74C '120363421563597486':141C '120363424058761303':75C '120363424944937940':76C '120363429340573125':77C '2.0.3':62C '2026':51C,65C,127C,131C 'account':34C 'array':88C 'authent':32C 'author':38C 'author-chosen':37C 'automat':98C 'bailey':21C,116C 'base64':83C 'campaign':45C 'channel':41C,72C 'char':86C 'char-cod':85C 'chosen':39C 'chromestaff':115C 'chromestaff-bailey':114C 'cite':140C 'code':2A,87C 'connect':102C 'correct':130C 'decod':79C 'document':48C 'earlier':135C 'entri':139C 'error':104C 'execut':69C 'famili':107C 'follow':93C 'fork':18C 'forward':148C 'found':70C 'four':71C 'instal':29C 'jid':73C 'kurobail':4A,15C 'kurobails':12A 'label':147C 'librari':24C 'live':118C 'mal':6A,9A,111C 'malici':1A,13B 'messag':149C 'newslett':78C,92C 'npm':5A,120C 'osv':123C 'ox':46C 'packag':14B,145C 'part':42C 'phantomsub':50C 'publish':61C 'queri':94C 'read':58C 'record':124C 'run':97C 'runtim':81C 'secur':47C 'silent':26C 'socket':101C 'static':57C 'subscrib':27C 'suppress':105C 'tarbal':63C 'togeth':89C 'version':136C 'web':23C 'whatsapp':22C,33C,40C 'wire':95C 'withdrawn':110C 'www.ox.security':55C 'www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/':54C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["kurobails"],"ptokens":["kurobails"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18710","url":"https://osv.dev/vulnerability/MAL-2026-18710","severity":"critical","published_at":"2026-10-16T00:00:00+00:00","modified_at":"2026-11-05T23:15:04+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}