GCVE-110-OSM-2026-11541

This is a covert account-manipulation package: the OSV advisory’s described WhatsApp newsletter auto-follow behavior is credible and fits the suspicious construction patterns in this fork of @whiskeysockets/baileys. The package also has an install-time entrypoint (`preinstall: node ./engine-requirements.js`) and multiple high-severity persistence/exfiltration findings, while the attacker model is clear: abuse the victim’s authenticated WhatsApp session to follow attacker-chosen channels. The recovered IOC `131.0.0.0` is classified as custom C2/exfil, and the package’s obfuscated string handling plus `fetch('https:` network activity strengthen the case that this is not a normal library fork. The upstream-like metadata does not outweigh the malicious behavior; this should be treated as a malicious supply-chain package from a compromised/forked publisher seeking account abuse. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/chats.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Utils/generics.js: "fetch('https:" - Network Request in lib/Utils/messages-media.js: "request({ hostname: parsedUrl.hostname, port: parsedUrl.port || (parsedUrl.proto..." OBFUSCATION - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/WABinary/constants.d.ts: "["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746",..." - String Array Obfuscation in lib/WABinary/constants.js: "[ '1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746'..." - Strings Extracted from Deobfuscated Code in lib/Utils/chat-utils.js - Strings Extracted from Deobfuscated Code in lib/Utils/validate-connection.js ADDITIONAL FINDINGS - Platform Detection with Data Collection in lib/Socket/messages-send.js: "JSON.stringify({ sections: sex })).toS" PAYLOAD FILES lib/Utils/generics.js (+ lib/Utils/messages-media.js, lib/Utils/chat-utils.js)