shadowmd

{"schema_version":"1.7.4","id":"MAL-2026-17405","published":"2026-10-04T23:22:05Z","modified":"2026-10-04T23:42:39.704407682Z","summary":"Malicious code in shadowmd (npm)","details":"This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the\nvictim's account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer's own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: shadowmd (npm), version(s): 8.6.87.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (926dc7dcc164af51175755e81a7a6eabb878244ecc173974ab577a1569ce1ff4)\nlib/Socket/messages-send.js at lines 425 and 436 reconstructs the URL https://fiora.nixel.my.id/ from a String.fromCharCode decimal-ASCII array rather than a plain string literal. The host is assembled inside the package's WhatsApp socket message-send code path, so on every message-send flow the runtime resolves to an off-host destination whose identity is hidden from source-level inspection. Obfuscated destination reconstruction in a messaging library's send path is the fingerprint of a Baileys-family fork that intercepts or mirrors session/message data through an author-controlled endpoint; the destination fiora.nixel.my.id is unrelated to the WhatsApp protocol and is not documented as a caller-configurable endpoint.\n","affected":[{"package":{"name":"shadowmd","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["8.6.87"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/Socket/messages-send.js","sha256":"a62ea8d3d1172824095369efa66412a189a70812354a8d5790b4e9d50004a376","tlsh":"ee63926508fb192a4623b0b57e6bb401b134d0077148ec69ff8c86e85f8a464e6f7bdd"}],"package_integrity":[{"filename":"shadowmd-8.6.87.tgz","hashes":{"sha1":"c0fdb25db5797debf63f6865af9d3db6db402aa0","sha512_sri":"sha512-gRum9B4++CHkds2kFjqAZKnUsnBNsrvtCq4Jfkmv0NaQjSec5uozgFMH30ibLZxtm1L4ueqpPy7P9HfT+dZQdg=="}}]}}}],"references":[{"type":"ARTICLE","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/shadowmd/v/8.6.87"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020933","import_time":"2026-10-04T23:40:43.451168613Z","modified_time":"2026-10-04T23:22:05Z","sha256":"926dc7dcc164af51175755e81a7a6eabb878244ecc173974ab577a1569ce1ff4","source":"amazon-inspector","versions":["8.6.87"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","type":"FINDER"}]}