Official company update
PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels
OX Security·ox.security·
What the source says
490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp. Overview The OX Research team identified 101 npm packages as part of a malicious WhatsApp group subscriber
Checking access…
The original publication, including any images and updates, remains with the publisher.
Checking free source access…
More about OX Security
Official · ox.security“Shai-Hulud: Here We Go Again” – “tensorlake” npm Package Hit With MalwareOfficial · ox.securitySSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud CredentialsOfficial · ox.securityCVE-2026-93355: Account Takeover in LiteLLMOfficial · ox.securityHow MCP Is Bypassing a Decade of Cloud Security Best Practices