MAL-2026-18669

    Dashboard / Malicious Package / MAL-2026-18669

    MAL-2026-18669

    Published: 26 Oct 2026Last Modified: 5 Nov 2026

    Summary: Malicious code in @alannxds/baileys (npm)

    Details: @alannxds/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363371199176376@newsletter, 120363387182851100@newsletter, 120363421367985094@newsletter (stored base64-encoded), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).

    References: https://www.npmjs.com/package/@alannxds/baileys, https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/

    Affected packages

    Package

    Name: @alannxds/baileys

    Purl: pkg:npm/%40alannxds/baileys

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.2.10
    MAL-2026-18669 | CVE-DB