@xatancchii/velycxbail

{"schema_version":"1.7.4","id":"MAL-2026-17383","published":"2026-10-04T23:23:32Z","modified":"2026-10-04T23:42:34.816579541Z","summary":"Malicious code in @xatancchii/velycxbail (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @xatancchii/velycxbail (npm), version(s): 1.1.0.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (594062e4a945ccd7c67e7a5f03085fbd2eecda766d5347b81e7012399fb1f447)\npackage.json declares `\"libsignal\": \"npm:@bellaxchuu/libsignal-node@latest\"`, aliasing the Signal-protocol crypto dependency to a package published under the unrelated `@bellaxchuu` scope with the mutable `latest` tag and no integrity check. Every `npm install` of @xatancchii/velycxbail resolves libsignal to whatever the current head of `@bellaxchuu/libsignal-node` is at install time. The aliased package is consumed by lib/Utils/crypto.js, which is reached from the main entry through the Utils layer, so arbitrary future content published to that third-party scope loads and executes as part of normal use. The scope does not match the Baileys/WhatsApp publisher chain the fork claims to derive from, so control over the code path executed on installers rests with an unrelated third party.\n","affected":[{"package":{"name":"@xatancchii/velycxbail","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"1a7b67d5f33eba7565188d46a66b0412731b80483ed73ee52aba6639153ede1f","tlsh":"5f81dd34cd58cea30ac626e9a5bd0042a4b558539ec1fc1cb35547ac8f1e25f72b9f2d"}],"package_integrity":[{"filename":"velycxbail-1.1.0.tgz","hashes":{"sha1":"843dffd0247e477d76240c11517ed2ca6e9e2469","sha512_sri":"sha512-Ji4PN+BxAj2/oFnOqh6RaaGSRBBy6BgAqQefNMKZuu1FIA2qcNpZthP8Tq5lYMhzrO4vHc5/KdpqqJhc+9szkA=="}}]},"iocs":{"domains":[],"files":[],"ips":[],"urls":["https://t.me/xatanchinfo"]}}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@xatancchii/velycxbail/v/1.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020942","import_time":"2026-10-04T23:40:44.41189437Z","modified_time":"2026-10-04T23:23:32Z","sha256":"594062e4a945ccd7c67e7a5f03085fbd2eecda766d5347b81e7012399fb1f447","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}