Malicious Code Injection in noxxleys Package: Covert Channel Subscription Vulnerability
Summary
MAL-2026-17403: Malicious code in noxxleys (npm). Affects noxxleys versions 1.0.0 – 1.1.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The noxxleys package is part of a larger family of forks derived from the Baileys WhatsApp Web library. It is designed to facilitate interactions with WhatsApp's socket layer. However, this package has been identified as having a significant security vulnerability that allows malicious actors to exploit users' authenticated sessions to subscribe them to unwanted channels without their consent.
Vulnerability Detail
The vulnerability originates from the injection of malicious code into the noxxleys package, which executes an unauthorized FOLLOW query against attacker-controlled WhatsApp Channel/Newsletter JIDs. This occurs silently after the user connects, leveraging the user's own authenticated WhatsApp session. The obfuscation techniques used to hide the target JIDs include plain string literals, base64 encoding, and dynamic fetching of target lists from remote sources. While this vulnerability does not exfiltrate credentials or execute arbitrary code, it compromises user privacy and consent.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall noxxleysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the noxxleys package from their project until a fix is applied. This can be done using the command: npm uninstall noxxleys. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The noxxleys package has a critical vulnerability that allows for unauthorized channel subscriptions through malicious code injection. Users are advised to update to the latest version or remove the package to protect their accounts. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source dependencies.
See every vulnerability recorded for noxxleys →
FAQ
The noxxleys package is a fork of the Baileys WhatsApp Web library, designed to facilitate interactions with WhatsApp's socket layer.
The vulnerability allows attackers to silently subscribe users to unwanted WhatsApp channels using their authenticated sessions, compromising user consent and privacy.
If you have the noxxleys package installed in your project, it is recommended to check for updates or remove the package to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground.
If immediate updates are not possible, consider removing the package or using alternative solutions until a fix is available.
