{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "148bc48cc1b31f0ff70c18f99f5ed016ef7b992e0e6e4068b7efef190e8643c4",
              "tlsh": "0a81ed34cd28cea306c626e9a5bd0142947958535ec2fc1cb35547ac8f1e25f72b9f2d"
            }
          ],
          "package_integrity": [
            {
              "filename": "teambails-1.1.4.tgz",
              "hashes": {
                "sha1": "2e35bf9e2ce99a968c174017480eda70f2e76f68",
                "sha512_sri": "sha512-Sws7plzUQxMrHOn2IBOmTT1P8jdfYqn8JwYUhPrR90M57KlporqM+dL0RqvF9PvqzLTVAPlCh/93iMihddi2sA=="
              }
            }
          ]
        },
        "iocs": {
          "domains": [
            "s.whatsapp.net"
          ],
          "files": [],
          "ips": [],
          "urls": [
            "https://api.telegram.org/bot",
            "https://api.telegram.org/bot$",
            "https://t.me/Xatanicvxiik2"
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@bellaxchuu/teambails"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.1.9",
        "1.1.8",
        "1.1.6",
        "1.1.4",
        "1.2.4"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "name": "OX Security",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021339",
        "import_time": "2026-10-09T17:16:16.932197479Z",
        "modified_time": "2026-10-09T17:11:36Z",
        "sha256": "156864e18d7755186cdd5958add80e528a83848fa2dcdae81c73484208640120",
        "source": "amazon-inspector",
        "versions": [
          "1.1.4"
        ]
      },
      {
        "id": "IN-MAL-2026-021340",
        "import_time": "2026-10-09T17:16:17.031917332Z",
        "modified_time": "2026-10-09T17:11:45Z",
        "sha256": "ff1f46da9000b191689b227d86fec5a8002f6e3ff73470304df9f7bc53f57667",
        "source": "amazon-inspector",
        "versions": [
          "1.1.6"
        ]
      }
    ]
  },
  "details": "This package is part of a large family (100+ identified as of September 2026) of near-identical\nforks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into\nthe WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW\nquery (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter\nJIDs, using the installer\u0027s own authenticated WhatsApp session -- silently subscribing the\nvictim\u0027s account to channels it never asked to join.\n\nThe target JID(s) are hidden from casual source review via one of several obfuscation techniques\nobserved across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code\narray reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote\nJSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change\nafter installation without a new npm publish. Every sample in the family shares the same underlying\nmechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after\nconnect), even though the package name, JID value(s), and obfuscation/delivery method differ per\nfork.\n\nThe malicious action abuses the installer\u0027s own authenticated WhatsApp session to gain reach and\nsubscribers for attacker-controlled channels; it does not exfiltrate credentials, establish\npersistence, or execute arbitrary remote code.\n\nAffected package: @bellaxchuu/teambails (npm), version(s): 1.1.9, 1.1.8, 1.1.6, 1.1.4, 1.2.4.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ff1f46da9000b191689b227d86fec5a8002f6e3ff73470304df9f7bc53f57667)\npackage.json declares the `libsignal` dependency as `github:Bellaxata/libsignal-node` with no commit SHA, tag, or branch pin. On `npm install`, npm resolves the current HEAD of that repository\u0027s default branch and installs its contents into node_modules, running any lifecycle scripts (preinstall/install/postinstall/prepare) present in the fetched tree. The resolved bytes are whatever the repository owner pushes at install time, delivered with no version pin and no integrity check. The GitHub account hosting the dependency is separate from the npm publishing scope, and the source is not the npm registry. A minor static match on lib/Utils/generics.js line 403 (`ping`) appears in ordinary utility code and is not independently indicative of malicious behavior.\n",
  "id": "MAL-2026-17348",
  "modified": "2026-10-09T17:18:12.807866330Z",
  "published": "2026-10-09T17:11:36Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@bellaxchuu/teambails/v/1.1.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@bellaxchuu/teambails/v/1.1.6"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @bellaxchuu/teambails (npm)"
}