101 npm packages secretly add devs' WhatsApp to groups

Researchers found 101 malicious npm packages exploiting the Baileys WhatsApp project to add developers’ accounts to groups without consent. The packages, collectively downloaded nearly 500,000 times, use three variants to subscribe users to attacker-controlled channels. The groups, primarily Indonesian, promote gaming accounts, in-game resources, and other services. Developers should check for unauthorized group memberships and block suspicious packages.