Cybersecurity
101 npm packages add developers to WhatsApp groups
OX Security said 101 npm packages linked to a PhantomSub campaign used Baileys-based code to add developers to WhatsApp groups, with downloads reaching 490,000 and related activity reported before.
- OX Security said it had identified 101 npm packages tied to a campaign it called PhantomSub.
- The packages were said to add developers' WhatsApp accounts to groups without consent and had been downloaded 490,000 times, including 116,000 times in the previous 30 days.
- OX Security said 19 packages fetched channel IDs from GitHub at runtime, 60 stored them in clear text, and 14 stored them in encoded or obfuscated form.
- SafeDep and the Xygeni Security Research Team had previously reported related Baileys forks and a mod that subscribed bots to attacker-controlled channels.
OX Security said it had identified 101 npm packages that formed a campaign it called PhantomSub. It said the packages used Baileys-based code to add developers to WhatsApp groups without consent.
The researchers Nir Zadok, Moshe Siman Tov Bustan and Vitalii Chepurko said the packages had been downloaded 490,000 times in total, with 116,000 of those downloads in the previous 30 days. OX Security said 19 packages pulled channel IDs from GitHub when run, 60 stored the IDs in clear text, and 14 kept them encoded or obfuscated.
The article said related activity had already been reported. SafeDep said in August 2026 that it found Baileys forks that made installers follow channels controlled by the package author and added an advertising URL to images and videos sent by the bot.
It also said the Xygeni Security Research Team had earlier this month disclosed @dappaoffc/baileys-mod, which was found to subscribe a developer's authenticated WhatsApp bot session to attacker-controlled newsletter channels. OX Security said developers should check whether they had been added to the groups, block them, set detection rules for the Baileys packages, and avoid packages that require a personal WhatsApp account to be connected.
Named in this story
People
- Nir Zadok
- one of the OX Security researchers quoted in the report
- Moshe Siman Tov Bustan
- one of the OX Security researchers quoted in the report
- Vitalii Chepurko
- one of the OX Security researchers quoted in the report
Companies
- GitHub
- the source of channel IDs in one malware variant
Organisations
- OX Security
- analysed the package cluster and published the write-up
- SafeDep
- first reported related Baileys forks in August 2026
- Xygeni Security Research Team
- previously disclosed a related Baileys mod
Products and systems
- npm
- the package registry that hosted the malicious packages
- PhantomSub
- the name OX Security gave the campaign
- Baileys
- the WhatsApp open-source project abused by the packages
- the platform whose groups, channels and accounts were targeted
How the source tells it
A technical security report in a restrained, advisory register, with no distinct emotive framing beyond standard threat terminology.
No emotive framing was found in the original.