Malicious Code Injection in @fazzcodestudio/wa-web: Unauthorized WhatsApp Channel Subscriptions
Summary
MAL-2026-17441: Malicious code in @fazzcodestudio/wa-web (npm). Affects @fazzcodestudio/wa-web versions 0.3.0 – 0.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @fazzcodestudio/wa-web package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with WhatsApp's web interface. It allows developers to build applications that can send and receive messages, manage contacts, and utilize WhatsApp's features programmatically. However, this package has been compromised, leading to unauthorized actions being performed using the installer's WhatsApp account.
Vulnerability Detail
This vulnerability arises from malicious code injected by the publisher, which automatically subscribes users to WhatsApp Channels without their consent. The code is triggered upon establishing a connection to the WhatsApp socket, utilizing the user's authenticated session to send a follow request to a specific channel. The default configuration enables this behavior, and users are not informed of this action in the README documentation. The potential ramifications include unauthorized use of the user's account to inflate subscriber counts for the publisher's channels.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @fazzcodestudio/wa-webIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the auto-follow feature by setting the undocumented configuration option in their application code. Add the following line to your configuration: autoFollowNewsletterOnConnect: false. This will prevent the automatic subscription to channels upon connection.
Conclusion
The @fazzcodestudio/wa-web package has been compromised, leading to unauthorized subscriptions to WhatsApp Channels using the user's account. Users are advised to update the package to the latest version and implement the provided workaround until an update can be applied. Regular monitoring for vulnerabilities using tools like Vulert is recommended.
See every vulnerability recorded for @fazzcodestudio/wa-web →
FAQ
The package contains malicious code that automatically subscribes users to WhatsApp Channels without their consent.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
As a temporary measure, you can disable the auto-follow feature by setting autoFollowNewsletterOnConnect: false in your configuration.
Static analysis of the package shows no evidence of credentials being sent off-host, but the unauthorized use of your account remains a significant risk.
The vulnerability was identified by Rising Sun Solutions LLC, who reported the malicious behavior of the package.
