Malicious Code Injection in levvleys Package: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17397: Malicious code in levvleys (npm). Affects levvleys versions 2.0.10 – 2.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The levvleys package is a part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to facilitate interactions with WhatsApp through a web interface. However, this package has been identified as having a significant security flaw that allows malicious actors to exploit the user's authenticated WhatsApp session without their consent.
Vulnerability Detail
The vulnerability in the levvleys package stems from its ability to inject malicious code into the WhatsApp socket layer. Upon connection, this code executes an authenticated 'w:mex' FOLLOW query against attacker-controlled WhatsApp Channel/Newsletter JIDs. This action subscribes the victim's account to channels without their knowledge. The obfuscation techniques used to conceal the target JIDs make it difficult for users to detect the malicious behavior. Although the vulnerability does not exfiltrate credentials or execute arbitrary remote code, it compromises the user's account by subscribing them to unwanted channels.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall levvleysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the levvleys package until they have updated to the patched version. Additionally, users should review their installed packages and remove any versions of levvleys that are vulnerable.
Conclusion
The levvleys package has a serious vulnerability that allows malicious code to exploit users' WhatsApp sessions. It is crucial for users to update to the latest patched version to protect their accounts from unauthorized subscriptions. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for levvleys →
FAQ
levvleys is an npm package that facilitates interactions with WhatsApp through a web interface, but it has been found to contain malicious code.
The vulnerability allows attackers to subscribe your WhatsApp account to channels without your consent, potentially leading to unwanted notifications and interactions.
You should immediately update to the patched version (2.1.1) using the command 'npm install levvleys@2.1.1' to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
The malicious code uses various obfuscation techniques such as plain string literals, base64 encoding, and dynamic reconstruction of character arrays to hide the target JIDs from casual review.
