More than 100 malicious npm packages were uploaded to the JavaScript package registry and, when installed, used the victim’s machine to add their WhatsApp account to groups without permission. The packages targeted developers and abused post-install or runtime code to automate WhatsApp actions through the user’s active session, turning trusted development dependencies into a supply-chain attack; no CVE is cited in the article text provided.
Why it matters: Developers and organizations that install npm packages are exposed to account abuse through their own software tools, even if they did not expect a package to touch messaging apps. Affected users should identify and remove the packages, review WhatsApp group memberships and linked sessions, and audit development environments and dependency controls.
info@thehackernews.com (The Hacker News)
2026.09.29
100% relevant
This appears to establish a distinct supply-chain campaign centered on malicious npm packages that manipulate WhatsApp accounts, and it does not clearly match an existing tracked story in the list.
← Back to all stories