{"id":"MAL-2026-18713","kind":"package","aliases":["MAL-2026-18713"],"related":[],"title":"Malicious code in rafael-bails (npm)","description":"rafael-bails is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own authenticated WhatsApp account to an author-chosen WhatsApp Channel. Part of the campaign OX Security documented as \"PhantomSub\" (2026-09-28): https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/ . Static read of the published 1.1.3 tarball on 2026-10-16 (not executed) found a hardcoded channel JID 120363401521242390@newsletter together with the newsletter FOLLOW query wired to run automatically after the socket connects, with errors suppressed. Same family as the withdrawn MAL-2026-4519 (chromestaff-baileys 1.1.3). Live on npm with no OSV record as of 2026-10-16.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rafael-bails","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-16T00:00:00+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:28+00:00","updated_at":"2026-11-05T23:49:28+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':58C '-10':72C,122C '-16':73C,123C '-18713':10A,13A '-2026':9A,12A,106C '-28':59C '-4519':107C '/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/':62C '1.1.3':68C,111C '120363401521242390':81C '2026':57C,71C,121C 'account':40C 'authent':38C 'author':44C 'author-chosen':43C 'automat':92C 'bail':6A,21C 'bailey':27C,110C 'bails':16A 'campaign':51C 'channel':47C,79C 'chosen':45C 'chromestaff':109C 'chromestaff-bailey':108C 'code':2A 'connect':96C 'document':54C 'error':98C 'execut':75C 'famili':101C 'follow':87C 'fork':24C 'found':76C 'hardcod':78C 'instal':35C 'jid':80C 'librari':30C 'live':112C 'mal':8A,11A,105C 'malici':1A,17B 'newslett':82C,86C 'npm':7A,114C 'osv':117C 'ox':52C 'packag':18B 'part':48C 'phantomsub':56C 'publish':67C 'queri':88C 'rafael':5A,15A,20C 'rafael-bail':4A,19C 'rafael-bails':14A 'read':64C 'record':118C 'run':91C 'secur':53C 'silent':32C 'socket':95C 'static':63C 'subscrib':33C 'suppress':99C 'tarbal':69C 'togeth':83C 'web':29C 'whatsapp':28C,39C,46C 'wire':89C 'withdrawn':104C 'www.ox.security':61C 'www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/':60C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["rafaelbails"],"ptokens":["bails","rafael"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-16T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18713","url":"https://osv.dev/vulnerability/MAL-2026-18713","severity":"critical","published_at":"2026-10-16T00:00:00+00:00","modified_at":"2026-11-05T23:15:04+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}