GCVE-110-OSM-2026-10279

This looks like a credential-and-session theft loader masquerading as a WhatsApp automation package: the install hook in `package.json` runs `engine-requirements.js`, while the runtime code in `lib/Socket/socket.js` and `lib/Utils/messages-media.js` collects auth material and encodes it for transmission. The recovered strings `update.me`/`mmg.whatsapp.net`, plus hidden payloads in `lib/Socket/💥_💸messages-send.js` and `lib/Utils/generics.js`, show deliberate obfuscation and IOC concealment rather than normal library behavior. The `startup-persistence` hit referencing `.profile` indicates persistence on the victim machine, and the package’s attacker model is a compromised npm publisher using the install path to steal WhatsApp session credentials and maintain access. Given the critical static score and the publisher’s suspiciously themed package set (`@dreamguyxeon/libsignal-node`, `my-auto-follow-eltio`), this should be treated as malicious. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 2 exfil (custom-c2) - 6 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Utils/messages-media.js: "axios.get(" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Socket/💥_💸messages-send.js - IOCs Found in Deobfuscated Code in lib/Utils/generics.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Whitespace-Padded Hidden Payload in lib/Socket/💥_💸messages-send.js: "; let" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" (+5 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" PAYLOAD FILES lib/Utils/messages-media.js (+ lib/Socket/💥_💸messages-send.js, lib/Utils/generics.js)