GCVE-110-OSM-2026-14764

@danzxcode/danzx-bail is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/socket.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json (the URL itself stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342). Update 2026-11-06: a second covert path, in 9.0.5, 9.0.6 and 9.0.7. lib/Utils/messages-media.js exports loadBase, which makeNewsletterSocket (lib/Socket/newsletter.js) calls on every socket creation as loadBase(newsletterWMexQuery, QueryIds). 80 seconds later it fetches a channel list from a URL stored as base64 and, 5 seconds apart, calls newsletterWMexQuery(id, QueryIds.FOLLOW) for each entry, swallowing errors and logging nothing. 9.0.5 and 9.0.6: lib/Utils/messages-media.js sha256 b41905238c3feaad4f8eae25b8cd7acea4ae94ec0916e404d9baadc2a49575fd, URL https://ch-danzx.vercel.app/lyyn. 9.0.7: sha256 cc4da072e185d0312ea0fb7ea0d08edbde8645b6a0218759dca8ab011a85ad59, URL https://danzx-bail.vercel.app/lyyn. 9.0.5 has only this path, so it is added to the affected versions. CyberXYZ read every published version statically from the npm registry tarballs on 2026-11-06 (integrity verified); nothing was executed. Amazon Inspector described the same loadBase loop in @rixxcodex/baileys (MAL-2026-16483). Judge assessment: This package is consistent with a covert attacker-controlled WhatsApp session hijack that silently follows channels using the victim's authenticated account, matching the disclosed MAL-2026-18816 behavior and the recovered exfil URL. The static evidence is not just generic obfuscation: `lib/Socket/socket.js` hides domains with char-code arrays and deobfuscation recovered `updatedCreds.me` plus `https://danzx-bail.vercel.app/lyyn`, while `messages-media.js` contains the same encoded channel-list fetch path. The presence of startup persistence attempts via `.profile` in multiple files, along with base64 encoding of credentials and media hashes, supports an attacker model of covert data collection and remote command/control rather than a normal WhatsApp API library. I would treat this as a malicious package published by the `danzxofficial` maintainer to abuse installed users' authenticated WhatsApp sessions. ENTRY lib/index.js (main: ./lib/index.js) PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 4 exfil (custom-c2) - 3 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Utils/generics.js: "fetch("https:" OBFUSCATION - Decoded Base64 Content in lib/Utils/messages-media.js - Decoded Base64 Content in [deobfuscated] lib/Utils/messages-media.js - IOCs Found in Deobfuscated Code in lib/Socket/socket.js - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, "base64")" - Dynamic Base64 Decoding in lib/Socket/socket.js: "Buffer.from(str, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/messages-media.js: "Buffer.from(encoded, "base64")" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" (+9 more) PAYLOAD FILES lib/Utils/messages-media.js (+ lib/Socket/socket.js, [deobfuscated] lib/Utils/messages-media.js)