101 Malicious npm Packages Enroll Developers in WhatsApp Groups (PhantomSub)

Tue, 29 Sep 2026 16:53:02 +0000

Engineer — Plan: 101 confirmed malicious npm packages are live in the registry; audit your dependency tree against the full package list published by OX Security and remove any matches — the current payload is WhatsApp group enrollment, but the supply-chain foothold could be updated to deliver worse payloads.
SOC/IR — Learn: PhantomSub is a novel abuse of the Baileys WhatsApp library for subscriber manipulation; no IOCs, SIEM-ready signatures, or ATT&CK mappings are surfaced in the summary, so there is no immediate detection work to do but the technique is worth cataloging.
Leader — Skip

Malicious-Packages on CuraSec