GCVE-110-OSM-2026-11904

megan-baileys is a renamed fork of the Baileys WhatsApp Web library. In lib/Socket/newsletter.js, 90 seconds after makeNewsletterSocket is constructed, a base64-encoded string is decoded to https://files.gifted.co.ke/file/chJids.json, fetched with node-fetch, and every channel id in the response is followed on the user's own authenticated WhatsApp session using the FOLLOW query id 7871414976211147. The follow list is therefore publisher-controlled at runtime, and the URL is hidden from a plaintext search. makeNewsletterSocket is reached from makeWASocket through lib/Socket/messages-send.js, so the behaviour fires for every consumer of the package with no opt-in. The base64 dead-drop and the follow loop are present in all ten published versions (1.0.0 through 1.0.11). No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. files.gifted.co.ke appears to be a file host used by a wider bot ecosystem and is deliberately not listed as an attacker domain. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys). Judge assessment: This looks like a publisher-controlled attack against users of a WhatsApp Web library: `lib/Socket/newsletter.js` contains a hidden base64 dead-drop that resolves to `https://files.gifted.co.ke/file/chJids.json`, and the OSV advisory says the response is used to follow channel IDs on the user's authenticated session with no opt-in. The package is wired to run from `package.json` via `postinstall: node scripts/postinstall.js`, which installs an alias into the consumer's node_modules, broadening the reach of the malicious behavior. The obfuscation and hidden-I/O patterns in `lib/Socket/newsletter.js`, `lib/Utils/chat-utils.js`, and `lib/Signal/Group/*.js` are consistent with concealment, not normal library code. Attacker model: a supply-chain maintainer embedding runtime-controlled WhatsApp account manipulation into a renamed Baileys fork to silently execute actions for every consumer. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Socket/messages-send.js: ".profile" EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" OBFUSCATION - Decoded Base64 Content in lib/Socket/newsletter.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/session-utils.js: "Buffer.from(base64Data, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/WABinary/constants.js: "[ '1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746'..." (+7 more) ADDITIONAL FINDINGS - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" PAYLOAD FILES lib/Socket/newsletter.js (+ lib/Utils/chat-utils.js, lib/Utils/messages-media.js)