@bellaxchuu/belbails

{"schema_version":"1.7.4","id":"MAL-2026-17342","published":"2026-10-08T05:45:47Z","modified":"2026-10-08T05:48:03.705266399Z","summary":"Malicious code in @bellaxchuu/belbails (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @bellaxchuu/belbails (npm), version(s): 1.0.1.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (597ff47692113a399e64ec9a51aa5fed8f7372d20c2a1560b2528b357000d9bf)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n","affected":[{"package":{"name":"@bellaxchuu/belbails","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/Utils/generics.js","sha256":"b4214ae766b75ba70ca58b9afc975e73df363447bf3539ab23215747add7b0c1","tlsh":"7052d6516df3513906a3e1ea6b5fe016b339a4233609cce4bd1c83208f815a8d6e77d9"}],"package_integrity":[{"filename":"belbails-1.0.1.tgz","hashes":{"sha1":"d4caa00c1df9c064c2ef99efe6017ae1befbe521","sha512_sri":"sha512-/JuPfnksIt8f0mm8jETbNwagw7l2Z7faTXwyDwjyAToFix8eyAKt+dwPFWL0Ww1sDyD8VMF+M2QiFIZX9PwgPA=="}}]},"iocs":{"domains":[],"files":[],"ips":[],"urls":["https://t.me/tredictInfo"]}}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bellaxchuu/belbails/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021150","import_time":"2026-10-08T05:46:12.394635641Z","modified_time":"2026-10-08T05:45:47Z","sha256":"597ff47692113a399e64ec9a51aa5fed8f7372d20c2a1560b2528b357000d9bf","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}