Malicious Code Injection in @ikyyjee/ikyysingle: Covert WhatsApp Channel Subscription
Summary
MAL-2026-17358: Malicious code in @ikyyjee/ikyysingle (npm). Affects @ikyyjee/ikyysingle versions 1.7.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @ikyyjee/ikyysingle is a part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to interact with the WhatsApp API, allowing developers to build applications that can send and receive messages. However, this package has been identified to contain malicious code that exploits the user's authenticated WhatsApp session.
Vulnerability Detail
The vulnerability arises from the package's ability to inject a covert channel-subscription action into the WhatsApp socket layer. Upon connection, the malicious code executes an authenticated 'w:mex' FOLLOW query targeting attacker-chosen WhatsApp Channel/Newsletter JIDs. This action subscribes the victim's account to channels without their consent, leveraging obfuscation techniques to hide the target JIDs from casual review. The malicious code does not exfiltrate credentials or execute arbitrary remote code but does abuse the user's session for unauthorized subscriptions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @ikyyjee/ikyysingleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @ikyyjee/ikyysingle package from your project by executing: npm uninstall @ikyyjee/ikyysingle. This will prevent any malicious actions associated with the package until a fix is applied.
Conclusion
The @ikyyjee/ikyysingle package contains a serious vulnerability that allows malicious actors to exploit users' authenticated WhatsApp sessions for unauthorized channel subscriptions. It is crucial to update or remove the package to safeguard against potential risks.
See every vulnerability recorded for @ikyyjee/ikyysingle →
FAQ
The vulnerability involves malicious code that subscribes users to WhatsApp channels without their consent using their authenticated session.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The primary risk is unauthorized subscription to channels, which could lead to spam or unwanted content being sent to the user's account.
Yes, you can temporarily uninstall the package to prevent any malicious actions until a fix is available.
If you suspect that your account has been compromised, consider changing your WhatsApp credentials and monitoring your account for any unauthorized activity.
