<![CDATA[101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent]]>Cybersecurity researchers have uncovered a supply chain campaign involving 101 malicious npm packages designed to silently enroll developers into WhatsApp groups. The operation has been dubbed PhantomSub by OX Security, whose researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko detailed the findings in a technical report.

According to the researchers, the packages abuse the Baileys WhatsApp open source project to add victims to groups without their consent, effectively turning compromised developer environments into a subscriber funnel for the campaign.

Key points from the report:

  • 101 packages were identified as part of the PhantomSub cluster
  • The packages leverage the Baileys WhatsApp library to perform unauthorized group additions
  • Victims are added to WhatsApp groups without any consent or interaction
  • The activity was attributed to a coordinated subscriber campaign rather than an isolated incident

Developers who maintain npm dependencies should review their installed packages for anything matching this cluster and remove or replace suspicious modules. Since the malicious functionality centers on the WhatsApp integration provided by Baileys, any project that unexpectedly pulls in that library as a dependency warrants closer inspection.

Source: The Hacker News

Has anyone audited their project dependencies for packages tied to this PhantomSub cluster, and if so, what did you find?

]]>https://xploitlk.com/topic/563/101-malicious-npm-packages-add-developers-whatsapp-accounts-to-groups-without-consentRSS for NodeTue, 27 Oct 2026 07:51:29 GMTSun, 04 Oct 2026 10:30:23 GMT60