GCVE-110-OSM-2026-11542

This package is consistent with an attacker-controlled remote-command channel embedded in a WhatsApp bot fork: the OSV advisory identifies a hardcoded `SIGNAL_STREAM_URL` at `https://zone.api.br/api/owner/whatsapp-signal-stream` and a socket entrypoint that unconditionally subscribes to it. The static findings reinforce active abuse, including `download-execute-delete`, `dynamic-code-execution`, `startup-persistence`, and multiple `data-exfiltration-encoding` hits, which together fit malware that can execute payloads, persist, and exfiltrate session data. The likely attacker model is a supply-chain compromise of a dependency used by bot operators to silently commandeer authenticated WhatsApp sessions and push attacker-chosen actions. `engine-requirements.js` is only a Node version gate, but it does not mitigate the far more serious `lib/Socket/messages-send.js` and `lib/Utils/signal-stream.js` behavior. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/MessageBuilder.cjs: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" DESTINATION - 4 exfil (custom-c2) - 1 c2 (urls) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages.js: "Buffer.from(cover.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Socket/messages-send.js: "axios.post(" - Network Request in lib/Utils/generics.js: "fetch('https:" OBFUSCATION - Dynamic Base64 Decoding in lib/MessageBuilder.cjs: "Buffer.from(media, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - Unicode Escape Obfuscation in lib/MessageBuilder.cjs: "\u004E\u0049\u0058\u0045\u004C" - String Array Obfuscation in lib/WABinary/constants.d.ts: "["1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746",..." - String Array Obfuscation in lib/WABinary/constants.js: "[ '1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746'..." - Decoded Unicode Escape Content in lib/MessageBuilder.cjs - Strings Extracted from Deobfuscated Code in lib/MessageBuilder.cjs (+2 more) ADDITIONAL FINDINGS - Download Execute Delete Pattern in lib/Utils/messages-media.js: "execAsync(cmd); return outputPath; } finally { if (tempInputPath) { await fs.unl..." - Silent Process Execution in lib/MessageBuilder.cjs: "{ silent: true" - Dynamic Code Execution in lib/Socket/messages-send.js: "exec(this)" PAYLOAD FILES lib/MessageBuilder.cjs (+ lib/Socket/messages-send.js, lib/Utils/messages-media.js)