GCVE-110-OSM-2026-12753

This looks like a compromised WhatsApp-modification package used as an implant to exfiltrate data and persist on victims' machines, likely targeting operators of automated WhatsApp bots. The strongest evidence is the deobfuscated C2 at `https://fiora.nixel.my.id/` in `lib/Socket/messages-send.js`, plus recovered IOCs like `node.attrs.to`, `stanza.attrs.to`, and `productMsg.key.id` that were hidden behind char-code obfuscation. The package also sets a `preinstall` hook (`node ./engine-requirements.js`), writes to startup-related paths like `.profile`, and uses silent shell execution, which fits an attacker model of executing on install and hiding activity. Given the critical static score and recovered exfil/persistence indicators, I would treat this as an intentional malware dropper/backdoor rather than a legitimate library. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 8 exfil (custom-c2) - 2 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Utils/messages-media.js: "axios.get(" - System Information Collection in lib/index.js: "process.platform" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Socket/messages-send.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/Socket/messages-send.js: "["break", "case", "catch", "continue", "debugger", "delete", "do", "else", "fina..." - Unicode Escape Obfuscation in lib/Socket/messages-send.js: "\u004E\u0049\u0058\u0045\u004C" (+7 more) ADDITIONAL FINDINGS - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Silent Process Execution in lib/Socket/messages-send.js: "{ silent: true" - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" PAYLOAD FILES lib/Socket/messages-send.js (+ lib/Utils/messages-media.js)