101 npm packages stole nothing. They signed the developer's WhatsApp account up to a channel
2026-10-01Security
OX Security found 101 npm packages, downloaded about 490,000 times, that abuse the Baileys WhatsApp library. When a developer links their account, the package silently subscribes it to channels the operator controls, sometimes muting them so nothing appears. The product being manufactured is an audience, and the developer is the audience.