Malicious Code Injection in xvinleys Package: Covert Subscription to WhatsApp Channels
Summary
MAL-2026-17409: Malicious code in xvinleys (npm). Affects xvinleys versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xvinleys package is part of a larger family of npm packages that are forks of the Baileys WhatsApp Web library. These packages are designed to interact with the WhatsApp API, allowing developers to create applications that can send and receive messages. However, the xvinleys package has been identified as having malicious code that exploits the user's authenticated WhatsApp session to subscribe them to unwanted channels without their consent.
Vulnerability Detail
The vulnerability in the xvinleys package arises from its ability to inject malicious code into the WhatsApp socket layer. Upon connection, the package issues an authenticated 'w:mex' FOLLOW query to attacker-controlled WhatsApp Channel/Newsletter JIDs, using the victim's own WhatsApp session. This action occurs silently, without the user's knowledge, effectively subscribing them to channels they did not intend to join. The obfuscation techniques used to hide the target JIDs include plain string literals, base64 encoding, and runtime reconstruction, making it difficult for users to identify the malicious behavior through casual source review.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall xvinleysIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the xvinleys package from your project by executing the following command: npm uninstall xvinleys. This will prevent any malicious code from executing until a safe version is released.
Conclusion
The xvinleys package contains a serious vulnerability that allows for the covert subscription of users to unwanted WhatsApp channels. It is crucial for users to take immediate action by updating or uninstalling the package to protect their accounts. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for xvinleys →
FAQ
xvinleys is an npm package that is part of a family of forks of the Baileys WhatsApp Web library, designed for interacting with the WhatsApp API.
The vulnerability allows attackers to subscribe users to unwanted WhatsApp channels using their own authenticated session, without their consent.
You should update the package to a patched version or uninstall it to prevent any malicious actions.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
