GCVE-110-OSM-2026-11636

@modss/baileys is a renamed fork of the Baileys WhatsApp Web library published 2026-09-01 and 2026-09-02 under a scope created the same day. lib/Socket/newsletter.js sets NEWSLETTER_LIST_URL to https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json. On every connection.update with connection === 'open', autoFollowConfiguredNewsletters() fetches that list and issues an executeWMexQuery FOLLOW for each id on the user's own authenticated WhatsApp session, caching followed ids in session/followed-newsletters.json. An Indonesian comment in the file explains that the list lives on GitHub so channels can be added or removed without redeploying the code, i.e. the follow targets are publisher-controlled at runtime. All three published versions carry the identical handler. The package also aliases its libsignal dependency to @modss/libsignal, which pkgwarden read as a plain rename with no malicious content. No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys) and MAL-2026-13932 (my-auto-follow). Judge assessment: This looks like a publisher-controlled WhatsApp abuse loader that auto-follows attacker-chosen newsletters from a remote dead-drop, matching the attacker model in the deobfuscated `socket.js` code. The hidden URL recovered from `String.fromCharCode(..._u)` points to a GitHub-hosted `Newsletter.json`, and the code then issues `executeWMexQuery` with `newsletter_id` values on an authenticated session; `lib/Socket/newsletter.js` also shows HTTP exfiltration behavior. The install hook in `package.json` (`preinstall`/`postinstall`) increases blast radius, and the package is heavily obfuscated with `iocs-recovered` from deobfuscation plus custom-c2 IOCs like `updatedCreds.me` and `crockford.com`. The rapid-version-spam metadata and very new publisher account further support a malicious campaign rather than a legitimate Baileys fork. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 3 exfil (custom-c2) - 3 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - HTTP Data Exfiltration in lib/Socket/newsletter.js: "process.cwd(), "session", "followed-newsletters.json"); const NEWSLETTER_FETCH" - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Utils/generics.js: "fetch('https:" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Socket/socket.js - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, "base64")" - Dynamic Base64 Decoding in lib/Socket/socket.js: "Buffer.from(str, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/messages-media.js: "Buffer.from(s, "base64")" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" - String Array Obfuscation in lib/WABinary/constants.js: "[ "1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746"..." - Decoded Base64 Content in lib/Socket/socket.js (+9 more) ADDITIONAL FINDINGS - Dynamic Code Execution in lib/Utils/use-sqlite-auth-state.js: "exec(CREATE_SCHEMA_SQL)" - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES lib/Socket/socket.js (+ lib/Utils/messages-media.js, [deobfuscated] lib/Utils/messages-media.js)