PhantomSub — 101 npm packages forked from the Baileys WhatsApp library (ourin-baileys, @nexustechpro/baileys, levvleys, neuralwhatsapp, cloud-baileys, my-auto-follow…) silently subscribe the developer's WhatsApp account to scam channels when the bot runs; ~490,000 downloads, 116,000 in the last 30 days, only 16 removed at disclosure and several still publishing (OX Security, 2026-09-28)

View raw markdownEdit on GitHub ↗

TL;DR

OX Security's research team identified 101 npm packages that repackage Baileys — the unofficial WhatsApp Web API library developers use for support bots, chat managers and scrapers — with one addition: when the bot logs in with your WhatsApp account, the package subscribes that account to WhatsApp channels the operator chose, without telling you. Three variants differ only in where the channel list comes from: 19 packages fetch it from GitHub at runtime (so the operator can retarget without republishing), 60 hard-code it in cleartext, 14 base64-encode it, and 7 more were removed before OX could classify them. Combined downloads are ~490,000, 116,000 in the prior 30 days. The channels are Indonesian storefronts selling game accounts, TikTok accounts and bot services; the stolen subscriptions are social proof (follower counts of 800–4,800 per channel). Only 16 of the 101 had been removed by 2026-09-28, and the registry shows several of the named packages still publishing new versions on 09-28 and 09-30. Not a credential stealer — but it is a package that logs into your customer-facing WhatsApp account and acts as you.

What happened

OX's post (2026-09-28) and The Hacker News' coverage (09-29) describe the campaign. Baileys is a reverse-engineered WhatsApp Web client; hundreds of forks live on npm under names like *-baileys, *leys, *whatsapp, because the upstream project churns and forks promise "fixed" or "extended" builds. The malicious forks are functional — the bot works — which is why they accumulate downloads and why nobody notices. The subscribe call runs on connection. Thirty-two channels appear across multiple packages, which OX reads as one operator or one shared list; the runtime-fetched lists live in three public GitHub repositories (named in the OX post). OX names a contact tied to several of the storefronts and places the operation in Indonesia. Prior sightings of the same family: SafeDep flagged Baileys forks in August 2026, Xygeni disclosed @dappaoffc/baileys-mod earlier in September, and Xygeni's September digest calls cloud-baileys "one of the longest-running impersonations tracked."

Sample package names from the report: ourin-baileys, @nexustechpro/baileys, levvleys, neuralwhatsapp, cloud-baileys, my-auto-follow. Registry check 2026-09-30: all six still resolve with versions and latest tags; @nexustechpro/baileys published 2.2.8 on 2026-09-28 and 2.2.9 on 2026-09-30, cloud-baileys 1.1.41 on 09-18, my-auto-follow 1.0.7 on 09-20. No security-holder placeholders yet. That is why the status is active.

Why it matters to this audience: "build me a WhatsApp bot" is a common vibe-coding prompt, the agent picks a Baileys package by name similarity or star count, and the package gets the one thing a WhatsApp bot needs — a logged-in session for a real account, often the business's. Today the abuse is channel subscriptions. The same hook could send messages, read chats, or add the account to groups; the library already has every capability a stealer would want, so the difference between this campaign and a worse one is a few lines the operator has not written yet.

Am I affected?

# 1. Which Baileys variant did you install? Upstream is @whiskeysockets/baileys; anything else is a fork.
grep -E '"[^"]*(baileys|leys|whatsapp)[^"]*":' package.json package-lock.json 2>/dev/null | sort -u
npm ls 2>/dev/null | grep -iE 'baileys|leys|whatsapp'

# 2. The six OX named (there are 95 more — read the OX post for the full list)
grep -rE 'ourin-baileys|@nexustechpro/baileys|levvleys|neuralwhatsapp|cloud-baileys|my-auto-follow' package.json package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null

# 3. In the installed fork, look for channel/newsletter subscription calls you did not write
grep -rniE 'newsletter|subscribe|followNewsletter|idChannel|@newsletter' node_modules/*baileys*/ node_modules/*leys*/ 2>/dev/null | grep -v '\.d\.ts' | head

# 4. On the WhatsApp account the bot uses: Updates → Channels → check for channels you never followed

If you are affected

  1. In WhatsApp, unfollow and report the channels; treat the account as having been operated by a third party.
  2. Remove the fork, pin to upstream @whiskeysockets/baileys (or a fork you have read), and log the bot out of WhatsApp so the old session is revoked (Linked Devices → log out); delete the stored auth state directory the bot used.
  3. Because the runtime-fetch variant executes an operator-controlled list, assume the package's behaviour can change at any time: review the fork's source for outbound calls and any other network activity before reinstalling anything similar. playbooks/if-you-installed-a-bad-npm-package.md.

Prevention

  • Name the upstream explicitly. Ask the agent for @whiskeysockets/baileys and refuse the "fixed", "pro", "cloud" or "neural" variants; a fork of a library that holds a logged-in session is a package that can act as your account. prevention/package-vetting-checklist.md.
  • A working package is not a safe package. Download counts and "it runs" are exactly what this campaign optimises for; vet for what a library also does on connect. prevention/supply-chain-attack-surface.md.
  • Run bots on a dedicated WhatsApp account with nothing on it, never the business's primary line. prevention/credential-hygiene.md.

Sources