GCVE-110-OSM-2026-12761

This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect() reconstructs a URL from a char-code array (decoding to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json), fetches a JSON list from that mutable GitHub branch, and 200 seconds after connect iterates the list issuing authenticated `w:mex` queries with query_id 7871414976211147 (QueryIds.FOLLOW) against the installer's own WhatsApp session. A separate exported helper `generateMessageV` decodes a base64+XOR(key=23)-obfuscated string to a hardcoded `<digits>@newsletter` JID and invokes the same FOLLOW query. The obfuscation of both the URL (char-code array) and the JID literal (base64+XOR) exists solely to hide these targets from source review; upstream Baileys does not contain this code path. The runtime dependency `@whiskeysockets/eslint-config` is also declared as a mutable GitHub tarball reference (`github:whiskeysockets/eslint-config`) rather than a pinned registry range, so `npm install` resolves it to whatever that repository's default branch currently contains. The covert action uses the installer's authenticated identity to gain reach for author-chosen newsletter IDs but does not exfiltrate credentials, install persistence, or execute remote code on the installer's host; the harm is loss of control over the installer's WhatsApp account actions, not machine compromise. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json - Postinstall Script in package.json PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 3 exfil (custom-c2) - 3 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Utils/generics.js: "fetch('https:" OBFUSCATION - IOCs Found in Deobfuscated Code in lib/Socket/socket.js - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, "base64")" - Dynamic Base64 Decoding in lib/Socket/socket.js: "Buffer.from(str, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" - String Array Obfuscation in lib/WABinary/constants.js: "[ "1724", "profile_picture", "1071", "1314", "1605", "407", "990", "1710", "746"..." - Decoded Base64 Content in lib/Socket/socket.js - Decoded Base64 Content in lib/Utils/messages-media.js (x3) (+6 more) ADDITIONAL FINDINGS - Dynamic Code Execution in lib/Utils/use-sqlite-auth-state.js: "exec(CREATE_SCHEMA_SQL)" PAYLOAD FILES lib/Socket/socket.js (+ lib/Utils/messages-media.js) ## Additional context: PhantomSub campaign - Remote channel list(s), editable by the operator without publishing a new version (live on 2026-09-24): `hxxps://raw.github[.]com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json` (1 channel(s)) - Channel(s) the package promotes (channel ID, source in package): `0029VbBouHp0rGiGXagM0f2e` (Fyxzpedia.ID - Utama, postinstall banner). OX does not confirm these as auto-follow targets.