Plan
archived
101 Malicious npm Packages Enroll Developers in WhatsApp Groups (PhantomSub)
- Engineer — Plan: 101 confirmed malicious npm packages are live in the registry; audit your dependency tree against the full package list published by OX Security and remove any matches — the current payload is WhatsApp group enrollment, but the supply-chain foothold could be updated to deliver worse payloads.
- SOC/IR — Learn: PhantomSub is a novel abuse of the Baileys WhatsApp library for subscriber manipulation; no IOCs, SIEM-ready signatures, or ATT&CK mappings are surfaced in the summary, so there is no immediate detection work to do but the technique is worth cataloging.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.