Malicious Code Injection in @ikyyjee/ikyysinggle: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17357: Malicious code in @ikyyjee/ikyysinggle (npm). Affects @ikyyjee/ikyysinggle versions 1.7.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @ikyyjee/ikyysinggle is part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to interact with the WhatsApp socket layer, enabling functionalities related to messaging and channel subscriptions. However, this package has been identified to contain malicious code that exploits the user's authenticated WhatsApp session to subscribe them to channels without their consent.
Vulnerability Detail
The vulnerability arises from the injection of malicious code that executes an unauthorized FOLLOW query against attacker-controlled WhatsApp channels. This occurs when the package connects to the WhatsApp socket, using the installer's own authenticated session. The injected code employs various obfuscation techniques to hide the target channel identifiers, making it difficult for users to detect the malicious behavior. The implications include unauthorized subscriptions to channels, potentially leading to spam or unwanted content, although it does not exfiltrate user credentials or execute arbitrary remote code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @ikyyjee/ikyysinggleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the @ikyyjee/ikyysinggle package from their project to prevent any malicious activity. This can be done using the command: npm uninstall @ikyyjee/ikyysinggle.
Conclusion
The @ikyyjee/ikyysinggle package contains a serious vulnerability that allows for unauthorized channel subscriptions via malicious code. Users are advised to update or remove the package to mitigate risks. Regular monitoring for updates and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for @ikyyjee/ikyysinggle →
FAQ
The vulnerability involves malicious code that subscribes users to WhatsApp channels without their consent, using their authenticated session.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The main risk is unauthorized subscriptions to channels, which can lead to unwanted content and spam. However, it does not compromise user credentials or execute remote code.
Currently, there is no specific patched version available. Users should keep an eye on the npm repository for any updates.
As a temporary measure, you can uninstall the package using npm uninstall @ikyyjee/ikyysinggle to prevent any malicious activity.
