GCVE-110-OSM-2026-12755

sea-baileys is a fork of the Baileys WhatsApp Web library. Its package.json remaps the `libsignal` import specifier to `npm:@otaxayun/libsignal-node@latest` — an unrelated maintainer's package pinned to the mutable `latest` dist-tag rather than a fixed version or integrity hash. lib/Signal/libsignal.js routes the installer's Signal Protocol identity private key, signed pre-key private key, session records and sender keys through this dependency, so whatever code `@otaxayun/libsignal-node` resolves to at install time handles the consumer's WhatsApp cryptographic identity and message stream. Because the tag is mutable and owned by a third party outside the sea-baileys publisher, a single publish under that name replaces the crypto implementation on every subsequent `npm install`. Separately, lib/Utils/messages-media.js's prepareWAMessageMedia unconditionally attaches a hardcoded `annotations` block referencing the newsletter JID `120363409928671192@newsletter` ("HOSHINO AI INFORMATION") to every outgoing media message when the caller does not supply annotations, silently modifying consumer-generated WhatsApp payloads to advertise the fork author's channel. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Modded/message_builder.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 1 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Socket/socket.js.bak: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Network Request in lib/Utils/messages-media.js: "https.request(" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Modded/message_builder.js - Dynamic Base64 Decoding in lib/Modded/message_builder.js: "Buffer.from(media, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" (+7 more) ADDITIONAL FINDINGS - Silent Process Execution in lib/Modded/message_builder.js: "{ silent: true" - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Socket/messages-send.js: "require('child_process')" - Dynamic Code Execution in lib/Utils/rich-messages.js: "exec(line)" PAYLOAD FILES lib/Modded/message_builder.js (+ lib/Utils/messages-media.js, lib/Utils/chat-utils.js) ## Additional context: PhantomSub campaign - Removed from npm before its code could be reviewed, so the variant used is unknown.