Cybersecurity experts have found a set of 101 npm packages that are intended to trick developers into joining a WhatsApp subscription campaign called PhantomSub This article explores phantomsub malicious packages. . These malicious packages exploit the open-source WhatsApp project called "Baileys" to enrolll unsuspecting users into groups without their consent,” OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko wrote in a technical write-up.

Some of the packages are ourin-baileys, @nexustechpro/baileys, @badzz88/baileys, levvleys, @vanzxy/baileys, @yudzxml/baileys, @chatunity/baileys, @kelvdra/baileys, neuralwhatsapp, lilys-baileys, @fyxzpediaa/baileys, noxleyss, @xrelly-stack/baileys, alipclutch-baileys, kurobails, eliteprotech-baileys, @xayz/baileys, chromestaff-baileys, @sanzoffc/baileys, @sairidev/baileys-new, cloud-baileys, @nyzzpediaa/baileys-new, ishumdz-bail, nishiki-bail, diezyclutch-baileys, oktz-baileys, and my-auto-follow.

MONTE – BMG 1,000 followers Fyxzpedia. CORTANA TECH (1,300 followers)ID – Utama (4,800 followers) “The channels we identified are mostly small bot-sellers and ‘market’ channels, mostly in Indonesia, where follower counts act as social proof to sell bot scripts, bot-building services, ‘premium’ APKs and social-media boosting,” OX Security said.