Covert Channel Subscription Vulnerability in noxleyss Package
Summary
MAL-2026-17402: Malicious code in noxleyss (npm). Affects noxleyss versions 1.0.0 – 1.1.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The noxleyss package is a part of a large family of forks from the Baileys WhatsApp Web library, designed to facilitate interactions with WhatsApp's API. It allows developers to create applications that can send and receive messages, manage contacts, and perform various tasks within the WhatsApp ecosystem. However, this package has been identified as malicious, injecting covert actions that exploit the user's authenticated session.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the noxleyss package, which is part of a family of over 100 similar forks. Upon connecting to WhatsApp, the injected code executes an unauthorized FOLLOW query using the user's authenticated session, subscribing the victim's account to attacker-controlled channels without consent. The target channel identifiers are obfuscated to evade detection, and some variants can dynamically fetch these identifiers from remote sources, allowing attackers to change targets post-installation. This vulnerability does not exfiltrate user credentials or execute arbitrary code but manipulates the user's session for malicious purposes.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall noxleyssIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the noxleyss package until a patched version is released. Additionally, reviewing and monitoring the package-lock.json file can help identify any vulnerable dependencies.
Conclusion
The noxleyss package contains a significant vulnerability that allows unauthorized subscription to WhatsApp channels using the user's authenticated session. It is crucial for users to update to a safe version and monitor their dependencies to mitigate the risk of exploitation.
See every vulnerability recorded for noxleyss →
FAQ
The noxleyss package is a fork of the Baileys WhatsApp Web library, allowing developers to interact with WhatsApp's API.
The vulnerability allows attackers to subscribe users to channels without their consent, using their authenticated WhatsApp session.
You should update the noxleyss package to a patched version by running 'npm update noxleyss' in your terminal.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The malicious code uses various obfuscation techniques, including plain string literals, base64 encoding, and dynamic fetching of target identifiers.
