Socket’s Threat Research Team has uncovered two highly sophisticated malicious npm packages specifically designed to target developers building WhatsApp API integrations.
The packages, published by user “nayflore” using email idzzcch@gmail.com, implement a remote-controlled destruction mechanism that can completely wipe developers’ systems based on phone number verification.
The malicious packages, named “naya-flore” and “nvlore-hsc,” masquerade as legitimate WhatsApp socket libraries and have accumulated over 1,110 downloads within a month while remaining active on the npm registry.
Socket has submitted takedown requests to npm’s security team and petitioned for the suspension of the associated account.
Remote Kill Switch with Phone Number Database
The attack mechanism centers around a sophisticated kill switch embedded within the requestPairingCode function, which developers would naturally call during WhatsApp bot authentication setup.
The malicious code first retrieves a remote database of phone numbers from a GitHub repository using Base64-encoded URLs to avoid detection.
When developers execute the pairing function, the package checks their phone number against the remote whitelist hosted at https://raw.githubusercontent.com/navaLinh/database/main/seska.json.
If the phone number exists in the database, the package operates normally. However, if the number is not found, the system executes the devastating command rm -rf *, which recursively deletes all files in the current directory.
The whitelist appears to contain Indonesian mobile numbers, suggesting the threat actors may be selectively targeting developers outside their geographic region while protecting local users.
This approach allows the attackers to maintain operational security while maximizing damage to international developers.
Technical Infrastructure and Dormant Capabilities
Both packages contain identical but commented-out data exfiltration functions capable of sending device information to https://api.verylinh.my.id/running.
The presence of this dormant functionality suggests that the threat actors initially planned a comprehensive data collection effort but ultimately simplified their approach to focus on system destruction.
The “naya-flore” package also contains a hardcoded GitHub Personal Access Token (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), though its specific purpose remains unclear.
Security teams should monitor for any GitHub API activity associated with this identifier.
The attack exploits the growing WhatsApp Business API ecosystem, which now serves over 200 million businesses globally.
Developers regularly install packages like whatsapp-web.js and baileys for chatbot development, creating a high-trust environment that these malicious packages exploit through convincing WhatsApp socket implementations.
Organizations should immediately audit messaging-related packages for unexpected network requests and phone number requirements, while implementing network monitoring for suspicious GitHub API activity.
Indicators of Compromise (IOCs)#
Malicious Packages:
naya-florenvlore-hsc
Network Indicators:
https://api[.]verylinh[.]my[.]id/runninghttps://raw[.]githubusercontent[.]com/navaLinh/database/main/seska.json
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
_imresizer.jpg?fit=1068,580&ssl=1&description=Malicious npm Packages - Socket's Threat Research Team has uncovered two highly sophisticated malicious npm packages specifically designed){kind=link}