Covert Channel Subscription Vulnerability in noverojs Package
Summary
MAL-2026-17401: Malicious code in noverojs (npm). Affects noverojs versions 1.0.1 – 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The noverojs package is part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to facilitate interactions with the WhatsApp platform. However, this package has been identified as malicious, injecting covert actions into the WhatsApp socket layer, which can lead to unauthorized subscriptions to channels.
Vulnerability Detail
The vulnerability arises from malicious code embedded within the noverojs package, which is part of a family of over 100 similar forks. Upon connection, the code executes an authenticated 'w:mex' FOLLOW query targeting attacker-chosen WhatsApp Channel/Newsletter JIDs. This action uses the installer's authenticated WhatsApp session to silently subscribe the victim's account to channels without their consent. The obfuscation techniques employed to hide the target JIDs include string literals, base64 encoding, and runtime char-code arrays. This vulnerability does not exfiltrate credentials or execute arbitrary code but abuses the user's session for malicious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall noverojsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the noverojs package from their project until a secure version is confirmed. This can be done by executing the command: 'npm uninstall noverojs'. Additionally, users can monitor their applications for vulnerabilities using Vulert, which analyzes the package-lock.json file to provide real-time alerts for open-source vulnerabilities.
Conclusion
The noverojs package contains a significant vulnerability that allows unauthorized channel subscriptions through the user's WhatsApp session. It is crucial for users to update to the latest version or uninstall the package to mitigate risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for noverojs →
FAQ
The noverojs package is a fork of the Baileys WhatsApp Web library, designed to interact with the WhatsApp platform.
The vulnerability allows attackers to silently subscribe users to WhatsApp channels without their consent, using their authenticated session.
The affected versions of the noverojs package are 1.0.4 and 1.0.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider uninstalling it as a temporary measure and monitor your application for vulnerabilities using Vulert.
