registry / jexkcode / 1.1.1

jexkcode@1.1.1

OSV Malicious Advisory

imported 24d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16220 confirms this npm version as malicious. Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter support but does not disclose this automatic account modification. Versions through 1.1.1 used a malformed newsletter JID;...

Advisory

MAL-2026-16220

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in jexkcode (npm)

Details

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter support but does not disclose this automatic account modification. Versions through 1.1.1 used a malformed newsletter JID; version 1.1.2 corrected it. Subsequent commits removed both failure and success logs, so version 1.1.4 performs the automatic follow without visible output. This behavior is unrelated to the package's stated functionality and modifies the user's WhatsApp account without authorization.

Decision reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

References

OSV advisory PACKAGE WEB WEB WEB

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 108 file(s), 1.85 MB of source, external domains: call.whatsapp.com, github.com, raw.githubusercontent.com, wa.me, web.whatsapp.com, www.whatsapp.com

Oversized source lightweight scan

WAProto/index.js5.08 MB file, sampled 256 KB

No sampled risky behavior triggered.

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

•matchType = normalized_sha256 matchedPackage = @vanzxy/baileys@1.4.6 matchedPath = lib/WABinary/constants.js matchedIdentity = npm:QHZhbnp4eS9iYWlsZXlz:1.4.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

lib/Utils/validate-connection.jsView file

114pull: false, L115: devicePairingData: { L116: buildHash: appVersionBuf, ... L141: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L142: let hmacPrefix = Buffer.from([]); L143: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L165: ]); L166: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L167: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L114

WAProto/index.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

WAProto/index.jsView on unpkg

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 5329879 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/WABinary/constants.jsView on unpkg

Findings

5 High3 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretlib/WABinary/constants.js

HighSemantic Analysis LimitedWAProto/index.js

HighKnown Malware Source Similaritylib/WABinary/constants.js

HighSecret Patternlib/WABinary/constants.js

MediumNetwork

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptolib/Utils/validate-connection.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to jexkcode@1.1.1.

See version security history for other recorded verdicts.

Avoid installing jexkcode@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-16 10:15:09.146Z (UTC).

Source advisory published: 2026-09-16 00:00:00.000Z (UTC).