shadowmd
WhatsApp API Modification
This report shows the evidence for shadowmd@8.6.87, the only known version.
OpenSSF/OSV Malicious Advisory
imported 23d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17405 confirms this npm version as malicious.
Advisory
MAL-2026-17405
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in shadowmd (npm)
Details
This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
Affected package: shadowmd (npm), version(s): 8.6.87.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package contains a concrete exported shell-injection vulnerability in video thumbnail generation, but inspection found no malicious install hook, credential theft, exfiltration, or persistence. Flag it as a critical runtime risk rather than malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Runtime use of generateThumbnail with mediaType set to video and an untrusted file path.
Impact
Arbitrary commands may run with the privileges of the application using the package.
Mechanism
Unsafely interpolated file path executed through a shell.
AI rationale
The package contains a concrete exported shell-injection vulnerability in video thumbnail generation, but inspection found no malicious install hook, credential theft, exfiltration, or persistence. Flag it as a critical runtime risk rather than malware.
Evidence
lib/Utils/messages-media.jslib/index.jspackage.jsonengine-requirements.jslib/Defaults/index.jslib/Utils/index.js
Independent scan evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for AI warning decision
- An exported video-thumbnail path builds an ffmpeg shell command by interpolating the supplied file path and executes it with child_process.exec.
- Video thumbnail generation passes its file argument into that shell-command helper without quoting or validation.
- Importing the main entrypoint clears the console and prints promotional contact details.
Evidence against
- The preinstall script only enforces Node.js version and exits on unsupported versions.
- No credential harvesting, environment collection, AI-agent configuration changes, or attacker-directed exfiltration was found.
- Observed network defaults are WhatsApp service endpoints used by this WhatsApp client library.
Behavioral surface
ChildProcessCryptoFilesystemNetworkWebSocket
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node ./engine-requirements.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgWAProto/index.jsView file
•path = WAProto/index.js
kind = oversized_source_file
sizeBytes = 5329994
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkglib/Utils/messages-media.jsView file
•matchType = normalized_sha256
matchedPackage = my-auto-follow@1.0.3
matchedPath = lib/Utils/messages-media.js
matchedIdentity = npm:bXktYXV0by1mb2xsb3c:1.0.3
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
3 High4 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similaritylib/Utils/messages-media.js
HighAi Review Evidencelib/Utils/messages-media.js
MediumNetwork
MediumOversized Source FileWAProto/index.js
MediumStructural Risk Force Deep Review
MediumGit Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to shadowmd@8.6.87.
The versions list below shows the verdict for each recorded version.
- Avoid installing shadowmd@8.6.87. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.