focashi
WhatsApp API Modification By Ahmad Akbar
This report shows the evidence for focashi@1.1.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 23d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17392 confirms this npm version as malicious.
Advisory
MAL-2026-17392
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in focashi (npm)
Details
This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
Affected package: focashi (npm), version(s): 1.1.0.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The lifecycle hook is limited to enforcing Node 20 or later. The flagged network and process features are media and WhatsApp-library utilities reached by normal user calls, not an automatic attack chain.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Installation runs the version check; importing the module prints promotional text.
Impact
No automatic credential collection, exfiltration, persistence, or destructive behavior was found.
Mechanism
Node-version enforcement and user-invoked media utilities.
AI rationale
The lifecycle hook is limited to enforcing Node 20 or later. The flagged network and process features are media and WhatsApp-library utilities reached by normal user calls, not an automatic attack chain.
Evidence
package.jsonengine-requirements.jslib/index.jslib/Utils/messages-media.jslib/Utils/generics.js
Independent scan evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- A preinstall hook runs during installation.
- The main module prints promotional contact details when imported.
Evidence against
- The preinstall script only rejects Node versions below 20.
- No install-time network, file-harvesting, or project-mutation behavior was found.
- Third-party upload endpoints are in an exported media helper, not an automatic lifecycle path.
- No self-dependency, persistence, destructive action, or reviewer-directed text was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
GitDependency
Oversized source lightweight scan
WAProto/index.js8.08 MB file, sampled 256 KB
ChildProcess
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/WABinary/constants.jsView file
603patternName = google_api_key
severity = high
line = 603
matchedText = 'AIzaSyD...Lk',
High
High Secret
Package contains a high-severity secret pattern.
lib/WABinary/constants.jsView on unpkg · L603603patternName = google_api_key
severity = high
line = 603
matchedText = 'AIzaSyD...Lk',
High
Secret Pattern
Google API key in lib/WABinary/constants.js
lib/WABinary/constants.jsView on unpkg · L603lib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = levvleys@2.0.8
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:bGV2dmxleXM:2.0.8
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages-media.jsView on unpkg369try {
L370: const { default: decoder } = await eval('import(\'audio-decode\')');
L371: let audioData;
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/Utils/messages-media.jsView on unpkg · L369lib/Types/Message.jsView file
3exports.WAMessageStatus = exports.WAMessageStubType = exports.WAProto = void 0;
L4: const WAProto_1 = require("../../WAProto");
L5: Object.defineProperty(exports, "WAProto", { enumerable: true, get: function () { return WAProto_1.proto; } });
Medium
Dynamic Require
Package source references dynamic require/import behavior.
lib/Types/Message.jsView on unpkg · L3lib/Voip/wasm-engine.jsView file
51const node_worker_threads_1 = require("node:worker_threads");
L52: const CALL_WASM_AB_PROPS_JSON = process.env.CALL_WASM_AB_PROPS_JSON ?? "";
L53: const PTHREAD_POOL_SIZE = 20;
...
L58: try {
L59: const parsed = JSON.parse(raw);
L60: if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
...
L84: };
L85: const filterWorkerStderr = (chunk) => {
L86: const line = chunk.toString().trim();
L87: if (line && !line.startsWith("voip:") && !line.startsWith("still waiting")) {
L88: process.stderr.write(chunk);
L89: }
Medium
Unsafe Vm Context
Package source executes code through a VM context API.
lib/Voip/wasm-engine.jsView on unpkg · L51lib/assets/wasm/whatsapp.wasmView file
•path = lib/assets/wasm/whatsapp.wasm
kind = wasm_module
sizeBytes = 9819554
magicHex = [redacted]
Medium
WAProto/GenerateStatics.shView file
•path = WAProto/GenerateStatics.sh
kind = build_helper
sizeBytes = 301
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
WAProto/GenerateStatics.shView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 8472622
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgFindings
4 High9 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighHigh Secretlib/WABinary/constants.js
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighSecret Patternlib/WABinary/constants.js
MediumDynamic Requirelib/Types/Message.js
MediumUnsafe Vm Contextlib/Voip/wasm-engine.js
MediumNetwork
MediumEnvironment Vars
MediumShips Wasm Modulelib/assets/wasm/whatsapp.wasm
MediumShips Build HelperWAProto/GenerateStatics.sh
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvallib/Utils/messages-media.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to focashi@1.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing focashi@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.