Researchers identified a cluster of 101 npm packages — collectively downloaded 490,000 times, including 116,000 in the last 30 days — that add the installing developer's WhatsApp account to attacker-controlled groups and channels without consent, a campaign the OpenSourceMalware archive tracks through verified records for the PhantomSub activity and which is built on the open-source Baileys WhatsApp library. OX Security researchers Nir Zadok, Moshe Siman Tov Bustan and Vitalii Chepurko documented three variants: 19 packages fetch channel identifiers from GitHub at runtime, 60 embed them in cleartext, and 14 embed them encoded and obfuscated. The technical escalation is that several forks no longer merely subscribe the victim to content: OpenSourceMalware's verified record for sea-baileys shows the package's manifest remapping the libsignal import specifier to an unrelated maintainer's package pinned to @latest, and its record for @rixxcodex/baileys describes three undocumented channels that use the installer's authenticated WhatsApp session to perform account actions chosen by the author. The activity follows two earlier disclosures of the same shape — a set of Baileys forks reported in August and a Baileys mod published earlier in September — which indicates a persistent abuse pattern around a popular library rather than a one-off.

• Source article