GCVE-110-OSM-2026-11900

vinzz-wcli is a WhatsApp CLI whose main entry (index.js) sets `global.ownerr = "6285185667890@s.whatsapp.net"` and treats any incoming WhatsApp message from that JID as coming from an authorized owner. The `messages.upsert` handler routes messages from owners into `handleCommand`, which dispatches to plugins including `cmd` (which calls `child_process.exec` on the message text) and `eval` (which builds and runs an `AsyncFunction` from the message text). When an installer runs the CLI and pairs their own WhatsApp account, the hardcoded third-party number is silently added as an owner and can send arbitrary shell commands and JavaScript to be executed on the installer's host with the installer's privileges. The tarball also ships a second file, index2.js, which is not the declared main but contains the same hardcoded owner JID and the same messages.upsert -> handleCommand dispatch, providing an equivalent execution path if that file is invoked directly. ENTRY index.js (main: index.js) PERSISTENCE - Startup Persistence in func.js: ".profile" DESTINATION - 2 exfil (custom-c2) - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - System Information Collection in index.js: "process.platform" - System Information Collection in index2.js: "process.platform" - System Information Collection in plugins/ping.js: "process.platform" - System Information Collection in plugins/status.js: "process.platform" OBFUSCATION - IOCs Found in Deobfuscated Code in func.js - Dynamic Base64 Decoding in func.js: "Buffer.from(media, 'base64')" - Unicode Escape Obfuscation in func.js: "\u004E\u0049\u0058\u0045\u004C" - Decoded Unicode Escape Content in func.js (x5) - Decoded Unicode Escape Content in [deobfuscated] func.js (x4) - Obfuscation patterns: unicodeHeavy in func.js - Obfuscation patterns: hexHeavy in index2.js - recovered 1 urls, 1 domains, 1 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Silent Process Execution in func.js: "{ silent: true" - Very New NPM Publisher Account PAYLOAD FILES func.js