Security researchers have uncovered a malicious npm campaign involving 101 packages that abuse the open-source Baileys WhatsApp project to silently manipulate developers' authenticated WhatsApp accounts.
Tracked as PhantomSub, the campaign has accumulated approximately 490,000 downloads, including around 116,000 downloads in the 30 days preceding the September 28, 2026 disclosure. Researchers found that the packages can cause victims' WhatsApp accounts to follow attacker-controlled channels without their consent, helping inflate follower counts and promote scam-related content.
The campaign is particularly notable because it does not behave like conventional credential-stealing malware.
Instead, the attackers abuse the trust developers place in open-source dependencies and in packages that appear to be legitimate Baileys forks.
What is the PhantomSub campaign?
PhantomSub is a cluster of malicious npm packages identified by OX Security researchers.
The packages are based on or imitate Baileys, an unofficial WhatsApp Web API implementation used by developers to build automation bots and applications capable of interacting with WhatsApp accounts.
Developers commonly use Baileys-based projects for applications such as:
- WhatsApp automation
- Customer-support bots
- Messaging management
- Chat automation
- Data collection and other integrations
The malicious packages modify this functionality by inserting additional code that silently subscribes an authenticated WhatsApp account to attacker-controlled channels.
The developer may therefore install what appears to be a normal WhatsApp automation dependency while unknowingly allowing the package to perform actions that were never part of the application's intended functionality.
How serious is the campaign?
The scale of the campaign is significant.
OX Security identified 101 packages associated with PhantomSub. Collectively, the packages had approximately 490,000 downloads, with about 116,000 downloads occurring during the previous 30 days.
At the time of OX Security's September 28 report, 16 packages had been removed from npm, while many others remained available.
The campaign is also not limited to one package name.
Researchers found multiple package families, publishers and naming variations, making it possible for the same underlying behavior to continue even after individual packages are identified and removed.
This is an important characteristic of malicious package campaigns:
Removing one package does not necessarily remove the campaign.
How does PhantomSub work?
The basic attack flow is relatively straightforward:
Developer installs malicious Baileys package
↓
Application authenticates a WhatsApp account
↓
Malicious runtime code executes
↓
Target channel IDs are obtained
↓
WhatsApp account follows attacker-controlled channels
↓
Channels gain artificial follower numbers
In some variants, the channel list is retrieved remotely.
In others, the target channel identifiers are stored directly inside the package.
A third variant uses encoded or obfuscated channel information.
The remote-list approach is particularly interesting because it allows the operator to change targets without necessarily publishing a new npm package.
The package can retrieve an updated channel list at runtime and apply the new targets to already-installed copies.
Why does the campaign abuse Baileys?
The attack takes advantage of a legitimate trust relationship.
When developers use a Baileys-based package, they are intentionally giving the application access to an authenticated WhatsApp session.
That access is expected to be used for the application's legitimate messaging functionality.
A malicious fork can abuse the same access to perform additional actions.
This makes the attack fundamentally different from a traditional malicious package that simply executes a downloader during installation.
In the PhantomSub campaign, the malicious behavior is integrated into the application's runtime functionality.
That can make the package appear less suspicious during basic installation checks.
Three different PhantomSub variants
OX Security identified three primary approaches used by the malicious packages.
1️⃣ Remote channel lists
In the first variant, the package retrieves channel identifiers from external infrastructure, including GitHub-hosted files.
OX Security identified 19 packages using this approach.
The advantage for the attacker is flexibility.
The target list can be changed remotely without publishing another npm version.
This means a package already installed inside a development environment can potentially receive new targeting information later.
2️⃣ Channel IDs stored in cleartext
The second variant contains the target channel identifiers directly inside the package source code.
OX Security identified 60 packages using this technique.
The malicious logic is not necessarily located in an obviously suspicious file.
Researchers found examples where the code was inserted into existing Baileys modules or placed in files whose names and functionality could make the additional behavior less obvious during a casual review.
For example, malicious subscription logic was found in modules associated with message handling and Signal protocol functionality.
3️⃣ Encoded channel information
The third variant uses encoded channel information, including Base64-encoded data.
OX Security identified 14 packages using this approach.
One example uses encoded invitation information that is resolved at runtime before the WhatsApp account follows the target channel.
This is not sophisticated cryptography, but it increases the difficulty of detecting the campaign through simple source-code searches for known channel identifiers.
What happens to the affected WhatsApp accounts?
The immediate impact is primarily unauthorized WhatsApp channel subscriptions rather than traditional data theft.
OX Security reported that the campaign appears designed to inflate follower counts for attacker-controlled channels.
Some of the identified channels promoted content involving the sale of social-media accounts, gaming accounts, bot-related services and other potentially fraudulent or unwanted activity.
In some cases, the malicious code also mutes the channels after following them.
That behavior can reduce the likelihood that the developer immediately notices the unauthorized subscription.
At the same time, the additional follower can make the channel appear more legitimate to other users.
This creates a feedback loop:
Malicious package → unauthorized follower → inflated channel metrics → greater perceived legitimacy
PhantomSub is not primarily a credential stealer
One of the important distinctions in this campaign is what the researchers did not observe.
OX Security said the packages did not fit the typical pattern of malicious dependencies designed to steal API tokens, cryptocurrency or credentials.
Instead, the campaign abuses the authenticated WhatsApp session to perform unauthorized actions.
That distinction matters for detection.
Security teams that primarily search npm packages for:
- Credential theft
- Cryptocurrency theft
- Reverse shells
- Downloaders
- Obfuscated malware
- Destructive payloads
could potentially miss a package whose malicious behavior is simply an unauthorized API action.
The malicious action itself may be the signal.
Why can malicious npm packages be difficult to detect?
npm packages represent a significant software supply-chain risk because developers frequently depend on large numbers of third-party components.
npm itself identifies malicious package publication, typosquatting, dependency confusion and modification of existing packages as important threat categories. npm says it scans packages for known malicious content and runs packages to identify potentially malicious behavior, while its security teams investigate reported malicious content.
PhantomSub illustrates another challenge:
A package does not need to look like malware to behave maliciously.
A developer may see:
- A familiar project name
- A Baileys-compatible API
- Normal WhatsApp functionality
- No obvious installation script
- No credential-stealing payload
Yet the package may still contain unauthorized runtime behavior.
This makes software composition analysis and behavioral monitoring increasingly important.
What should developers do?
Developers using Baileys or other WhatsApp automation libraries should review their dependency tree carefully.
✅ Audit Baileys forks
Identify every Baileys-derived dependency in development environments, CI/CD systems and production applications.
Do not assume that a package is trustworthy simply because its name contains baileys.
The PhantomSub campaign used numerous package names and publisher accounts.
✅ Review package provenance
Check:
- Package publisher
- Repository URL
- Maintainer history
- Release history
- Dependency changes
- Unexpected forks
- Package age
- Download patterns
- Differences from the upstream Baileys project
A package that closely imitates a legitimate project deserves additional scrutiny.
✅ Review runtime WhatsApp activity
Unexpected WhatsApp channel subscriptions can be a valuable detection signal.
If an application is designed to send messages but suddenly begins following channels without corresponding application logic, investigate the dependency responsible.
✅ Monitor outbound connections
Some PhantomSub variants retrieve channel lists from external sources at runtime.
Security teams should therefore review unexpected outbound connections from WhatsApp automation processes, particularly connections to repositories or infrastructure not required by the application's intended functionality.
✅ Pin and review dependencies
Use lockfiles and controlled dependency update processes where appropriate.
Blindly installing the latest version of an unfamiliar package creates additional supply-chain exposure.
Dependencies should be reviewed before entering production environments, particularly when they have access to authenticated services or sensitive accounts.
What if a potentially malicious package was already installed?
If a company discovers that one of the identified packages was installed or executed, the investigation should go beyond simply uninstalling the dependency.
Security teams should determine:
- Which systems installed the package
- Which package version was used
- When it was installed
- Whether the package executed
- Which WhatsApp accounts were authenticated
- Whether unauthorized channels were followed
- What external infrastructure the package contacted
- Whether other suspicious dependencies were installed alongside it
If an affected WhatsApp session was used by a production application, review and re-establish the session according to the application's security procedures.
The objective is to establish whether the incident was limited to unauthorized channel activity or whether additional malicious behavior occurred.
Earlier warnings around Baileys forks
PhantomSub is not an isolated discovery.
Security researchers had already reported malicious Baileys forks during August and September 2026.
Xygeni previously analyzed @dappaoffc/baileys-mod, finding runtime code injection that silently subscribed authenticated WhatsApp bot sessions to attacker-controlled newsletter channels. The payload retrieved target information dynamically from GitHub and activated at runtime rather than relying on an obvious installation script.
OX Security's September research subsequently expanded the known scope to 101 packages.
This progression illustrates how malicious dependency campaigns can evolve through multiple package names and implementations while retaining the same underlying objective.
The bigger cybersecurity lesson
PhantomSub demonstrates that software supply-chain attacks do not always need to steal credentials or deploy ransomware to create a security problem.
A malicious dependency can abuse legitimate permissions to perform actions that the developer never intended.
That makes the distinction between:
“The package installed successfully”
and
“The package behaves as expected”
extremely important.
Traditional dependency management focuses heavily on versioning, vulnerabilities and license compliance.
Those controls remain important, but they do not necessarily answer a different question:
What is this dependency actually doing at runtime?
For packages that interact with authenticated services, that question becomes even more important.
Final thoughts
The PhantomSub campaign shows how attackers can turn the software supply chain into an indirect path to influence external services.
The 101 identified npm packages did not need to steal passwords or deploy conventional malware. By abusing Baileys' legitimate WhatsApp capabilities, they could silently manipulate authenticated accounts and inflate the audience of attacker-controlled channels.
The approximately 490,000 downloads associated with the identified packages demonstrate the potential reach of malicious dependencies, even when their behavior is relatively narrow.
Software supply-chain security must evaluate not only what a package contains, but also what privileges it receives and what it does with them.
A dependency that looks like a legitimate fork can still introduce unauthorized behavior into a trusted application.
