Covert Channel Subscription Vulnerability in focashi Package
Summary
MAL-2026-17392: Malicious code in focashi (npm). Affects focashi versions 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The focashi package is part of a large family of forks derived from the Baileys WhatsApp Web library. It is designed to facilitate interactions with the WhatsApp messaging platform. However, this package has been identified as having a serious vulnerability that allows malicious code to inject covert actions into the WhatsApp socket layer, compromising user privacy and control over channel subscriptions.
Vulnerability Detail
The vulnerability in the focashi package arises from its ability to inject malicious code that issues an authenticated 'w:mex' FOLLOW query to attacker-controlled WhatsApp channels. This occurs without the user's consent, using their own authenticated session. The malicious code is obfuscated using various techniques, making it difficult to detect during casual code reviews. The implications of this vulnerability include unauthorized subscriptions to channels, which can lead to unwanted notifications and potential exploitation of user data, although it does not exfiltrate credentials or execute arbitrary remote code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall focashiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the focashi package from your project until a secure version is released. This can be done using the command: npm uninstall focashi. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The focashi package contains a significant vulnerability that allows unauthorized channel subscriptions through malicious code injection. Users are advised to update the package to a secure version or remove it entirely until a fix is available. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for focashi →
FAQ
focashi is an npm package that facilitates interactions with the WhatsApp messaging platform but has been found to contain malicious code.
The vulnerability allows attackers to subscribe users to channels without their consent, potentially leading to unwanted notifications and exploitation.
While the vulnerability does not exfiltrate credentials, it compromises user control over channel subscriptions, which can lead to privacy concerns.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
If an immediate update is not possible, consider uninstalling the package and using alternatives until a secure version is available.
