101 Malicious npm Packages Add Developers’ WhatsApp Accounts to Groups Without Consent

September 29, 2026 · 1:45 pm 1 sources

Image: The Hacker News

Coverage

More coverage

• 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
  The Hacker News · September 29, 2026 13:45
  Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub. "The malicious packages abuse the 'Baileys' WhatsApp open source project to add the victims to groups without their consent," OX…