101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
-
Cybersecurity researchers have uncovered a supply chain campaign involving 101 malicious npm packages designed to silently enroll developers into WhatsApp groups. The operation has been dubbed PhantomSub by OX Security, whose researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko detailed the findings in a technical report.
According to the researchers, the packages abuse the Baileys WhatsApp open source project to add victims to groups without their consent, effectively turning compromised developer environments into a subscriber funnel for the campaign.
Key points from the report:
- 101 packages were identified as part of the PhantomSub cluster
- The packages leverage the Baileys WhatsApp library to perform unauthorized group additions
- Victims are added to WhatsApp groups without any consent or interaction
- The activity was attributed to a coordinated subscriber campaign rather than an isolated incident
Developers who maintain npm dependencies should review their installed packages for anything matching this cluster and remove or replace suspicious modules. Since the malicious functionality centers on the WhatsApp integration provided by Baileys, any project that unexpectedly pulls in that library as a dependency warrants closer inspection.
Source: The Hacker News
Has anyone audited their project dependencies for packages tied to this PhantomSub cluster, and if so, what did you find?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login