Security advisories
Advisories CyberXYZ publishes for vulnerabilities in our own products and for vulnerabilities we coordinate in open-source packages, plus the malicious-package reports we filed that are now on the public record.
Vulnerabilities with CVE IDs
Malicious packages we reported
These packages were malicious from their first release, so they get OSV malicious-package records (MAL-) and not CVE IDs (why). We filed them with the OpenSSF Malicious Packages project, which feeds OSV. Each record below credits CyberXYZ as finder. The version count is the number of versions listed in the OSV record. Do not install any of them. To check any other package, use CyberXYZ Check.
Reports still in review at OpenSSF (#1654, #1674, #1722, #1746) are added here once they are merged and their OSV records exist.
PhantomSub: Baileys forks that follow WhatsApp channels through your account
maliciousForks of the Baileys WhatsApp Web library that silently subscribe the installer's own WhatsApp account to channels chosen by the publisher. SafeDep reported the campaign first (10 August 2026), then Xygeni (18 September 2026); OX Security named it PhantomSub (28 September 2026). These 23 packages are CyberXYZ findings. Our write-up: PhantomSub at npm scale.
| OSV record | Package (npm) | Versions | Credit |
|---|---|---|---|
| MAL-2026-18685 | aemeath-baileys | 1 | CyberXYZ |
| MAL-2026-18669 | @alannxds/baileys | 1 | CyberXYZ |
| MAL-2026-18670 | @axo_cuy/baileyss | 3 | CyberXYZ |
| MAL-2026-18671 | @bellaxchan/bailtech | 1 | CyberXYZ |
| MAL-2026-18672 | @bellaxchan/eleventech | 1 | CyberXYZ |
| MAL-2026-18673 | @bellaxchan/sixtech | 1 | CyberXYZ |
| MAL-2026-18674 | @bellaxchan/techxatz | 1 | CyberXYZ |
| MAL-2026-18632 | canta-baileys | 1 | CyberXYZ |
| MAL-2026-18675 | @denzz221/baileys | 11 | CyberXYZ |
| MAL-2026-18676 | @dyllxnn/baileys | 1 | CyberXYZ |
| MAL-2026-18687 | ichigokurosaki-baileys | 1 | CyberXYZ |
| MAL-2026-18688 | kevinx-baileys | 3 | CyberXYZ |
| MAL-2026-18678 | @lekzox/baileys | 1 | CyberXYZ |
| MAL-2026-18690 | lunaaa-baileys | 4 | CyberXYZ |
| MAL-2026-18679 | @monze1239/baileys | 2 | CyberXYZ |
| MAL-2026-18691 | ndraawzz-baileys | 1 | CyberXYZ |
| MAL-2026-18680 | @raffnotdev/baileys | 1 | CyberXYZ |
| MAL-2026-18693 | ruby-baileys | 2 | CyberXYZ |
| MAL-2026-18681 | @sakataa/baileys | 3 | CyberXYZ |
| MAL-2026-18682 | @wanzforme/bails | 2 | CyberXYZ |
| MAL-2026-18702 | xzvbailss | 1 | CyberXYZ |
| MAL-2026-18683 | @zaxius/baileys | 1 | CyberXYZ |
| MAL-2026-18684 | @zyrennofficiall/baileys | 5 | CyberXYZ |
New names in known malware campaigns
maliciousEach package ships a payload byte-identical to an earlier OSV record, named in the campaign column. birch-css-utils was also found independently by Amazon Inspector.
| OSV record | Package (npm) | Versions | Campaign | Credit |
|---|---|---|---|---|
| MAL-2026-18331 | birch-css-utils | 5 | noelc-css-blender (MAL-2026-18249) | Amazon Inspector, CyberXYZ |
| MAL-2026-18677 | @k.vict1999/pino-std-serializers | 1 | pino-testkit (MAL-2026-16484) | CyberXYZ |
| MAL-2026-18689 | loader-utils-kit | 2 | pino-testkit (MAL-2026-16484) | CyberXYZ |
| MAL-2026-18692 | pino-std | 1 | pino-testkit (MAL-2026-16484) | CyberXYZ |
| MAL-2026-18694 | solidity-cat | 1 | hardhat-hold (MAL-2026-14246) | CyberXYZ |
| MAL-2026-18695 | solidity-gas-watcher | 1 | hardhat-roof (MAL-2026-17509), chai-foundry (MAL-2026-13356) | CyberXYZ |
| MAL-2026-18696 | solidity-map | 1 | hardhat-roof (MAL-2026-17509), chai-foundry (MAL-2026-13356) | CyberXYZ |
| MAL-2026-18697 | testtestkjkldfnjdfn | 1 | nebulajs-api (MAL-2026-17220) | CyberXYZ |
Dependency-confusion packages
maliciousPackages with internal-looking names whose install scripts send the installing machine's details to a collector.
| OSV record | Package (npm) | Versions | Campaign | Credit |
|---|---|---|---|---|
| MAL-2026-18686 | cs-core-api-phoenix | 1 | standalone | CyberXYZ |
| MAL-2026-18698 | wiasdcxc | 1 | troubleshooting (MAL-2026-17641) | CyberXYZ |
| MAL-2026-18699 | wiselllx | 2 | troubleshooting (MAL-2026-17641) | CyberXYZ |
| MAL-2026-18700 | wisewwasd | 1 | troubleshooting (MAL-2026-17641) | CyberXYZ |
| MAL-2026-18701 | wxwxtt | 10 | troubleshooting (MAL-2026-17641) | CyberXYZ |
Found something?
Email security@cyberxyz.io. We acknowledge every report within 72 hours. See the vulnerability disclosure policy for scope, timelines and safe harbour.