Malicious Code Injection in anuaja: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17386: Malicious code in anuaja (npm). Affects anuaja versions 1.0.0 – 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The anuaja package is part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to facilitate interactions with WhatsApp's web interface. However, this package has been identified as having a serious security vulnerability that allows malicious actors to exploit the user's authenticated WhatsApp session, leading to unauthorized subscriptions to channels.
Vulnerability Detail
The vulnerability originates from the injection of malicious code into the WhatsApp socket layer. Upon connection, this code executes an authenticated 'w:mex' FOLLOW query against attacker-controlled WhatsApp Channel/Newsletter JIDs, using the user's own session. This results in the victim's account being silently subscribed to channels without their consent. The obfuscation techniques used to hide the target JIDs include string literals, base64 encoding, and dynamic fetching of target lists from remote sources, making detection difficult. While the malicious action does not exfiltrate credentials or execute arbitrary code, it still poses a significant risk to user privacy and control over their WhatsApp interactions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall anuajaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the anuaja package from their project until a patch is confirmed. This can be done using the following command: npm uninstall anuaja. Additionally, users can monitor their package-lock.json file for any unauthorized changes or dependencies.
Conclusion
The anuaja package has been identified as having a serious vulnerability that allows for unauthorized channel subscriptions through malicious code injection. Users are advised to update or uninstall the package to mitigate risks. Continuous monitoring of dependencies is crucial for maintaining application security.
See every vulnerability recorded for anuaja →
FAQ
anuaja is an npm package that facilitates interactions with the WhatsApp Web interface, but it has been compromised to include malicious code.
The vulnerability allows attackers to silently subscribe your WhatsApp account to channels without your consent, potentially leading to unwanted notifications and privacy concerns.
You should immediately update the anuaja package to the latest version or uninstall it to protect your account from potential exploitation.
While this vulnerability does not exfiltrate credentials, it does misuse your authenticated session for unauthorized actions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
