https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 07:10:12 +0000 https://cve.radiocsirt.org/vuln/mal-2026-17419 <p><strong>Affected:</strong> PyPI: friendly-tools</p> <p>friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration.</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f) The package presents itself as &#39;Small greeting utilities&#39; but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer&#39;s Snowflake OAuth session token, calls snowflake.connector.connect with authenticator=&#39;oauth&#39; and role=&#39;ACCOUNTADMIN&#39;, then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN=&#39;arn:aws:iam::631484165566:role/pentests_s3_role&#39;, and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer&#39;s Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage.…</p> <p><strong>Affected:</strong> PyPI: friendly-tools</p> <p>friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration.</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f) The package presents itself as &#39;Small greeting utilities&#39; but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer&#39;s Snowflake OAuth session token, calls snowflake.connector.connect with authenticator=&#39;oauth&#39; and role=&#39;ACCOUNTADMIN&#39;, then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN=&#39;arn:aws:iam::631484165566:role/pentests_s3_role&#39;, and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer&#39;s Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage.…</p> https://cve.radiocsirt.org/vuln/mal-2026-17419 Thu, 01 Oct 2026 12:04:42 +0000 https://cve.radiocsirt.org/vuln/mal-2026-17426 <p><strong>Affected:</strong> npm: kartykgithub-ph-f</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: ghsa-malware (1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.</p> <p><strong>Affected:</strong> npm: kartykgithub-ph-f</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: ghsa-malware (1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.</p> https://cve.radiocsirt.org/vuln/mal-2026-17426 Fri, 02 Oct 2026 04:17:20 +0000 https://cve.radiocsirt.org/vuln/mal-2026-17425 <p><strong>Affected:</strong> npm: kartykgithub-ph-e</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: ghsa-malware (83e406902c3f8a5a3951ce0c776e78b867e679199c683b67d6f2df8059dcdf72) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.</p> <p><strong>Affected:</strong> npm: kartykgithub-ph-e</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: ghsa-malware (83e406902c3f8a5a3951ce0c776e78b867e679199c683b67d6f2df8059dcdf72) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.</p> https://cve.radiocsirt.org/vuln/mal-2026-17425 Fri, 02 Oct 2026 02:55:07 +0000 https://cve.radiocsirt.org/vuln/mal-2026-17424 <p><strong>Affected:</strong> npm: kartykgithub-ph-b</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: ghsa-malware (b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.</p> <p><strong>Affected:</strong> npm: kartykgithub-ph-b</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: ghsa-malware (b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.</p> https://cve.radiocsirt.org/vuln/mal-2026-17424 Fri, 02 Oct 2026 01:21:27 +0000 https://cve.radiocsirt.org/vuln/mal-2026-16333 <p><strong>Affected:</strong> npm: homestack-cheer</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: amazon-inspector (f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142) The package is published as homestack-cheer with description &#39;JS lib support cheerleading&#39;, but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world &#39;greet&#39; library. The ESM entrypoint declared in package.json &#39;module&#39; (src/index.js) and src/env_load.js each end with `new Function(atob(&#39;&lt;~180KB base64&gt;&#39;)).call(this)`, decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users&#39; browsers. The decoded payload checks `window.location` for the substring &#39;checkout&#39; and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id `__privateStripeFrame84331` to intercept card input. The divergence between the benign `main` (UMD greet) and the malicious `module` (ESM Function(atob(...))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package&#39;s headline file.</p> <p>## Source: ghsa-malware (b0622f60729e4dec05a0c9f802b4728a7c579d968532a87d664b759da856ad27) Any computer that has this package installed or running s…</p> <p><strong>Affected:</strong> npm: homestack-cheer</p> <p>--- _-= Per source details. Do not edit below this line.=-_</p> <p>## Source: amazon-inspector (f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142) The package is published as homestack-cheer with description &#39;JS lib support cheerleading&#39;, but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world &#39;greet&#39; library. The ESM entrypoint declared in package.json &#39;module&#39; (src/index.js) and src/env_load.js each end with `new Function(atob(&#39;&lt;~180KB base64&gt;&#39;)).call(this)`, decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users&#39; browsers. The decoded payload checks `window.location` for the substring &#39;checkout&#39; and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id `__privateStripeFrame84331` to intercept card input. The divergence between the benign `main` (UMD greet) and the malicious `module` (ESM Function(atob(...))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package&#39;s headline file.</p> <p>## Source: ghsa-malware (b0622f60729e4dec05a0c9f802b4728a7c579d968532a87d664b759da856ad27) Any computer that has this package installed or running s…</p> https://cve.radiocsirt.org/vuln/mal-2026-16333 Mon, 21 Sep 2026 03:31:35 +0000 https://cve.radiocsirt.org/vuln/mal-2026-17452 <p><strong>Affected:</strong> npm: xcvrenzcompany</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-99 define `AUTO_FOLLOW_JIDS`, three base64 strings decoded with `Buffer.from(..., &#34;base64&#34;)`, and when the connection opens (line 97) schedule a FOLLOW query for each, 90 seconds apart (cited line 85: `await newsletterWMexQuery(jid, QueryIds.FOLLOW);`). Decoded JIDs: `120363400505489366@newsletter`, `120363430764800148@newsletter` and `120363387182851100@newsletter`. There is no opt-out and the behavior is not documented. The npm maintainer account (`xzv-expzc`) also publishes `prastzy`.</p> <p>Line numbers refer to version 2.0.0; the same code is present in every published version listed under `affected`.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the victim&#39;s account to inflate…</p> <p><strong>Affected:</strong> npm: xcvrenzcompany</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-99 define `AUTO_FOLLOW_JIDS`, three base64 strings decoded with `Buffer.from(..., &#34;base64&#34;)`, and when the connection opens (line 97) schedule a FOLLOW query for each, 90 seconds apart (cited line 85: `await newsletterWMexQuery(jid, QueryIds.FOLLOW);`). Decoded JIDs: `120363400505489366@newsletter`, `120363430764800148@newsletter` and `120363387182851100@newsletter`. There is no opt-out and the behavior is not documented. The npm maintainer account (`xzv-expzc`) also publishes `prastzy`.</p> <p>Line numbers refer to version 2.0.0; the same code is present in every published version listed under `affected`.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the victim&#39;s account to inflate…</p> https://cve.radiocsirt.org/vuln/mal-2026-17452 https://cve.radiocsirt.org/vuln/mal-2026-17451 <p><strong>Affected:</strong> npm: wailib</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/messages-recv.js` lines 45-72 define a char-code decoder (`qvnr`) and use it to build two channel JIDs, `120363428355171197@newsletter` and `120363425751417260@newsletter`, and the method names `newsletterFollow` (`pzha`, cited line 62: `const pzha = qvnr([`) and `newsletterMute` (`wjcf`, line 68), so neither the JIDs nor the method names appear in the source as text. Lines 1125-1140, in the `connection.update` handler, wait 30 seconds after the connection opens and then, for each JID, call `sock[pzha](id)` to follow the channel and, 3 seconds later, `sock[wjcf](id)` to mute it, so the victim is not notified of the channel&#39;s posts. There is no opt-out. The README (Portuguese) states &#34;Sem auto-follow de canais — removida a rotina que seguia canais automaticamente apos conectar&#34; (&#34;No channel auto-follow — the routine that followed channels automatically after connecting was removed&#34;), which the shipped code contradicts. The code is derived from `noxleyss` (MAL-2026-17402), whose name it still uses in `package/lib…</p> <p><strong>Affected:</strong> npm: wailib</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/messages-recv.js` lines 45-72 define a char-code decoder (`qvnr`) and use it to build two channel JIDs, `120363428355171197@newsletter` and `120363425751417260@newsletter`, and the method names `newsletterFollow` (`pzha`, cited line 62: `const pzha = qvnr([`) and `newsletterMute` (`wjcf`, line 68), so neither the JIDs nor the method names appear in the source as text. Lines 1125-1140, in the `connection.update` handler, wait 30 seconds after the connection opens and then, for each JID, call `sock[pzha](id)` to follow the channel and, 3 seconds later, `sock[wjcf](id)` to mute it, so the victim is not notified of the channel&#39;s posts. There is no opt-out. The README (Portuguese) states &#34;Sem auto-follow de canais — removida a rotina que seguia canais automaticamente apos conectar&#34; (&#34;No channel auto-follow — the routine that followed channels automatically after connecting was removed&#34;), which the shipped code contradicts. The code is derived from `noxleyss` (MAL-2026-17402), whose name it still uses in `package/lib…</p> https://cve.radiocsirt.org/vuln/mal-2026-17451 https://cve.radiocsirt.org/vuln/mal-2026-17450 <p><strong>Affected:</strong> npm: rubbydev-crash-baileys</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-70 (cited line 68: `QueryIds.FOLLOW`) run in the body of `makeNewsletterSocket`, so they fire whenever a socket is created: 10 seconds later the code sends a FOLLOW query for the channel JID `120363427594836299@newsletter`, stored as the base64 literal `MTIwMzYzNDI3NTk0ODM2Mjk5QG5ld3NsZXR0ZXI=` and decoded with `Buffer.from(..., &#34;base64&#34;)`. There is no opt-out and the behavior is not documented.</p> <p>Line numbers refer to version 1.0.0.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the victim&#39;s account to inflate the publisher&#39;s channel subscribers.</p> <p>SHA-256 of the published npm tarball(s): 1.0.0: `6f864bd56ccace95160247ff88e51a463a7655ce0daa083ac6748c714970e016`.</p> <p><strong>Affected:</strong> npm: rubbydev-crash-baileys</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-70 (cited line 68: `QueryIds.FOLLOW`) run in the body of `makeNewsletterSocket`, so they fire whenever a socket is created: 10 seconds later the code sends a FOLLOW query for the channel JID `120363427594836299@newsletter`, stored as the base64 literal `MTIwMzYzNDI3NTk0ODM2Mjk5QG5ld3NsZXR0ZXI=` and decoded with `Buffer.from(..., &#34;base64&#34;)`. There is no opt-out and the behavior is not documented.</p> <p>Line numbers refer to version 1.0.0.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the victim&#39;s account to inflate the publisher&#39;s channel subscribers.</p> <p>SHA-256 of the published npm tarball(s): 1.0.0: `6f864bd56ccace95160247ff88e51a463a7655ce0daa083ac6748c714970e016`.</p> https://cve.radiocsirt.org/vuln/mal-2026-17450 https://cve.radiocsirt.org/vuln/mal-2026-17449 <p><strong>Affected:</strong> npm: prastzyy</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-103 define `AUTO_FOLLOW_JIDS`, eight base64 strings decoded with `Buffer.from(..., &#34;base64&#34;)`, and when the connection opens (line 102) schedule a FOLLOW query for each, 90 seconds apart (cited line 90: `await newsletterWMexQuery(jid, QueryIds.FOLLOW);`). Decoded JIDs: `120363430764800148@newsletter`, `120363400505489366@newsletter`, `120363427794786523@newsletter`, `120363428149518339@newsletter`, `120363411665168068@newsletter`, `120363410421978309@newsletter`, `120363426605069018@newsletter` and `120363425633124233@newsletter`. There is no opt-out and the behavior is not documented.</p> <p>Line numbers refer to version 1.0.0.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the vict…</p> <p><strong>Affected:</strong> npm: prastzyy</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-103 define `AUTO_FOLLOW_JIDS`, eight base64 strings decoded with `Buffer.from(..., &#34;base64&#34;)`, and when the connection opens (line 102) schedule a FOLLOW query for each, 90 seconds apart (cited line 90: `await newsletterWMexQuery(jid, QueryIds.FOLLOW);`). Decoded JIDs: `120363430764800148@newsletter`, `120363400505489366@newsletter`, `120363427794786523@newsletter`, `120363428149518339@newsletter`, `120363411665168068@newsletter`, `120363410421978309@newsletter`, `120363426605069018@newsletter` and `120363425633124233@newsletter`. There is no opt-out and the behavior is not documented.</p> <p>Line numbers refer to version 1.0.0.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of the vict…</p> https://cve.radiocsirt.org/vuln/mal-2026-17449 https://cve.radiocsirt.org/vuln/mal-2026-17448 <p><strong>Affected:</strong> npm: prastzy</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-101 define `AUTO_FOLLOW_JIDS`, six base64 strings decoded with `Buffer.from(..., &#34;base64&#34;)`, and when the connection opens (line 100) schedule a FOLLOW query for each, 90 seconds apart (cited line 88: `await newsletterWMexQuery(jid, QueryIds.FOLLOW);`). Decoded JIDs: `120363427794786523@newsletter`, `120363428149518339@newsletter`, `120363411665168068@newsletter`, `120363410421978309@newsletter`, `120363426605069018@newsletter` and `120363425633124233@newsletter`. There is no opt-out and the behavior is not documented. The npm maintainer account (`xzv-expzc`) also publishes `xcvrenzcompany`.</p> <p>Line numbers refer to version 1.0.0.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of th…</p> <p><strong>Affected:</strong> npm: prastzy</p> <p>This package is a fork of the Baileys WhatsApp Web library (npm) and belongs to the &#34;PhantomSub&#34; family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer&#39;s own authenticated WhatsApp session to subscribe that account to WhatsApp Channels (newsletters) the publisher chose, by sending the WhatsApp `w:mex` FOLLOW query (query_id 7871414976211147) for each target channel JID.</p> <p>`package/lib/Socket/newsletter.js` lines 62-101 define `AUTO_FOLLOW_JIDS`, six base64 strings decoded with `Buffer.from(..., &#34;base64&#34;)`, and when the connection opens (line 100) schedule a FOLLOW query for each, 90 seconds apart (cited line 88: `await newsletterWMexQuery(jid, QueryIds.FOLLOW);`). Decoded JIDs: `120363427794786523@newsletter`, `120363428149518339@newsletter`, `120363411665168068@newsletter`, `120363410421978309@newsletter`, `120363426605069018@newsletter` and `120363425633124233@newsletter`. There is no opt-out and the behavior is not documented. The npm maintainer account (`xzv-expzc`) also publishes `xcvrenzcompany`.</p> <p>Line numbers refer to version 1.0.0.</p> <p>Static review of the published tarball(s) found no code that sends WhatsApp credentials or session keys off-host, no install-time payload (the only install hook is Baileys&#39; stock Node.js version check in `engine-requirements.js`), and no persistence; the payload runs when an application creates a WhatsApp socket with the library. The harm is the covert use of th…</p> https://cve.radiocsirt.org/vuln/mal-2026-17448