GCVE-110-OSM-2026-10281

This package is consistent with an attacker-controlled WhatsApp/Baileys fork that installs a preinstall hook and then hides payload logic behind heavy obfuscation, debugger traps, and encoded strings. The strongest indicator is the custom exfiltration path: `lib/Socket/socket.js` is classified as `update.me` / `mmg.whatsapp.net` custom-C2 and explicitly base64-encodes credential material like `creds.noiseKey.public` and `creds.signedIdentityKey.public`, which matches credential-and-session theft by a malicious publisher. The `package.json` preinstall of `node ./engine-requirements.js` guarantees code execution on install, and the attacker model here is a supply-chain implant publisher shipping a trojanized Baileys build to steal WhatsApp session data and route it to attacker infrastructure. The obfuscated files (`lib/index.js`, `lib/WABinary/encode.js`, `lib/Socket/messages-send.js`) and the suspicious domain set (`update.me`, `creds.me`, `sock.ws`) reinforce that this is not normal library minification but concealment of malicious behavior. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Utils/messages-media.js: "axios.get(" OBFUSCATION - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - Hex Encoded Strings in lib/Socket/messages-send.js: ""\x66\x72\x6f\x6d\x43\x6f\x64\x65\x50\x6f\x69\x6e\x74"" - Unicode Escape Obfuscation in lib/Socket/messages-send.js: "\u0041\u0069\u0046\u0045\u0075\u007d\u004b\u007a\u0079\u0048\u0048\u006a\u0070\u..." - Hex Encoded Strings in lib/WABinary/encode.js: ""\x31\x32\x30\x4c\x34\x57\x79\x45\x2a\x33\x6f\x2e\x34\x66\x70\x64\x74\x70\x57\x5..." (+12 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" PAYLOAD FILES lib/Utils/messages-media.js (+ lib/Utils/chat-utils.js)