A cluster of 101 npm packages has been identified as part of a campaign dubbed PhantomSub, which secretly adds developers to WhatsApp groups without their consent, according to OX Security researchers. These malicious packages leverage the open-source "Baileys" project to facilitate this unauthorized subscription campaign, based on information published by The Hacker News.The malicious npm packages, collectively downloaded 490,000 times, exploit the "Baileys" WhatsApp open-source project to subscribe developers to various WhatsApp groups. Researchers have identified three variants of the malware: one fetches channel IDs from GitHub at runtime, another embeds them in cleartext within its source code, and the third uses encoded and obfuscated channel IDs. The targeted groups appear to be primarily Indonesian, marketing mobile games, applications, and in-game resources, with follower counts used as social proof for selling bot scripts and related services.Developers are advised to check for unauthorized WhatsApp group subscriptions, block suspicious groups, and implement detection rules for malicious "Baileys" npm packages. It is also recommended to avoid using packages that require a personal WhatsApp account connection.Source: The Hacker News
