Skip to content
corpus.blog
Claim your blog
Record · corpus.blog/posts/01a0f210-3aa9-72da-8469-63ccaa6d99ab

PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels

ox.security · published 28 September 2026 · 12 min read

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at ox.security (opens in a new tab) Wayback capture (opens in a new tab)

1blog citing

First cited
30 Sept 2026
Most recent
30 Sept 2026
Rank this month
not ranked
External links
22
Words captured
2,548

How it is described

The words blogs link this post with, by how many different blogs use them.

  • “ox security” 1 blog

Cited by 1 blog in 1 post

One row per blog, the most recently citing first. Each shows the blog's newest citing post; open a row for the others.

Blog
Newest citing post
Date
news.risky.biz1 post
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia

linked as “Ox Security”

Read at the source (opens in a new tab)
30 Sept 2026

Similar posts

Baileys npm forks farm WhatsApp Channel followers
safedep.io
10 Aug 2026
Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
opensourcemalware.com
6 Aug 2026
ChainDrop: Inside a Self-Propagating npm Worm
Unit 42
6 Aug 2026
Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions
mend.io
29 Aug 2026
Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
Sonatype Blog
10 Aug 2026
AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)
Chainguard Blog
14 Jul 2026
A malicious npm package hidden three dependencies deep: the ulid-xyz delivery chain
safedep.io
1 Sept 2026
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
Unit 42
15 Jul 2026
Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign
research.jfrog.com
21 Sept 2026
The OpenSourceMalware Show #16
opensourcemalware.com
8 Aug 2026

Links from this post

Link
Host
Baileys npm forks farm WhatsApp Channel followers Read at the source (opens in a new tab)
safedep.io
https://osv.dev/list?ecosystem=npm&q=baileys
osv.dev
https://xygeni.io/blog/malicious-npm-package-in-baileys-fork-skyzopedia-case/
xygeni.io
https://unpkg.com/cantarella-baileys@1.1.13/lib/Socket/newsletter.js
unpkg.com
https://unpkg.com/@rixxcodex/baileys@9.0.0/lib/Utils/messages-media.js
unpkg.com
https://unpkg.com/jexkcode@1.1.2/lib/Utils/auto-follow.js
unpkg.com
https://unpkg.com/@kanaraa/baileys@3.5.2/lib/Socket/messages-recv.js
unpkg.com
https://unpkg.com/@lekzo/baileys@0.0.8/lib/Signal/Group/Protocols.js
unpkg.com
https://unpkg.com/spencer-baileys@1.0.4/lib/Socket/newsletter.js
unpkg.com
https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json
raw.github.com
https://unpkg.com/
unpkg.com
https://github.com/WhiskeySockets/Baileys
github.com
https://raw.githubusercontent.com/skyzopedia/Screaper/refs/heads/main/idChannel.json
raw.githubusercontent.com
https://files.gifted.co.ke/file/chJids.json
files.gifted.co.ke
https://raw.githubusercontent.com/LevviCodeID/Levi4than/refs/heads/main/levvleys.json
raw.githubusercontent.com
https://raw.githubusercontent.com/FallEzz/baileys-corp/refs/heads/main/news.json
raw.githubusercontent.com
https://raw.githubusercontent.com/iyedahruss/all-public-db/refs/heads/main/newsletter.json
raw.githubusercontent.com
https://raw.githubusercontent.com/MikuDevReal/V2.0/refs/heads/main/pepek.json
raw.githubusercontent.com
https://raw.githubusercontent.com/budetzz/mazzbudetzzzzz/refs/heads/main/joinchgua.json
raw.githubusercontent.com
https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json
raw.githubusercontent.com
https://raw.githubusercontent.com/noxXza/data/refs/heads/main/noxleys.json
raw.githubusercontent.com
https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json
raw.githubusercontent.com
Elsewhere on ox.security (5)

Something wrong here? Report a problem

A post on ox.security, published 28 September 2026, is cited by 1 distinct blog to date (corpus.blog, measured 8 October 2026).