{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14669","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-05-23T14:02:28Z","dateUpdated":"2026-11-05T23:25:34Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"This package is a fork of the Baileys WhatsApp library that quietly makes the installer's WhatsApp account follow and mute channels controlled by the package author, without consent. It is part of the PhantomSub campaign, which inflates follower counts for channels that sell accounts, bot scripts and similar goods. It does not steal credentials or crypto, but it modifies the victim's account and exposes them to scam content.\n\n## Payload 1: WhatsApp channel auto-follow\n\nMalicious payload found in: unknown (not stated in source)\n\n- Trigger: code inside the bundled Baileys fork, active while the package is connected to a WhatsApp account.\n- Behavior: calls the newsletter follow and mute functions for each channel ID it holds, using the connected account.\n- Channel IDs are hardcoded in the package.\n- Shared channel(s) also followed by other packages in this campaign: `120363400362472743@newsletter`","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/aec3b9e8-bdd7-45ba-917e-56ab03a7f67b","name":"Malicious npm package: kurobails","tags":["advisory"]},{"url":"https://registry.npmjs.org/kurobails","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"kurobails","collectionURL":"https://registry.npmjs.org","packageName":"kurobails","repo":"","defaultStatus":"affected","versions":[{"version":"all","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}