GCVE-110-OSM-2026-12093

This package contains concealed WhatsApp channel-following behavior consistent with engagement abuse. Two independent paths automatically follow and mute channels using the connected account. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" - Startup Persistence in lib/Utils/messages.js: ".profile" DESTINATION - 14 exfil (custom-c2) - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Socket/newsletter.js: "fetch("https:" - System Information Collection in lib/Utils/browser-utils.js: "os.platform()" OBFUSCATION - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/Utils/messages.js: "['break','case','catch','continue','debugger','delete','do','else','finally','fo..." - String Array Obfuscation in lib/WABinary/constants.js: "[ '1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746'..." - Strings Extracted from Deobfuscated Code in lib/Signal/Group/sender-key-state.js (+4 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" - Publisher Shows Burner-Account Pattern - Malicious Dependency Detected in package.json PAYLOAD FILES lib/Utils/chat-utils.js (+ lib/Utils/messages.js, lib/Utils/messages-media.js)