GCVE-110-OSM-2026-14765

@elfhkry/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/socket.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/elf.json (the URL itself stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342). Update 2026-11-06: 8.0.11 and 8.0.12 also carry a second covert path. lib/Utils/messages-media.js (sha256 486a040f10373d4c2b365eb8c997ec295fef3878c01b6013be1f69b0536b371c) exports loadBase(n, q, groupAcceptInvite), which makeNewsletterSocket calls on every socket creation. 80 seconds later it fetches https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/ell.json (stored as base64) and sends QueryIds.FOLLOW for each id, then fetches invite codes from https://raw.githubusercontent.com/Fhkryy/Fhkry/refs/heads/main/GROUP.json (also base64) and calls groupAcceptInvite(code) for each, joining the account to WhatsApp groups chosen by the publisher. Errors are swallowed and nothing is logged. CyberXYZ read every published version statically from the npm registry tarballs on 2026-11-06 (integrity verified); nothing was executed. Amazon Inspector described the same loadBase loop in @rixxcodex/baileys (MAL-2026-16483). Judge assessment: This is a covert WhatsApp-account hijack/subscription loader: the package silently issues FOLLOW queries and group-join actions from the victim's authenticated session using runtime-fetched lists from `raw.githubusercontent.com/Fhkryy/Fhkry/.../ell.json` and `GROUP.json`. The evidence is not just heuristic; `lib/Socket/socket.js` and `lib/Utils/messages-media.js` contain recovered/extracted IOCs, char-code/base64 obfuscation, and the exfil path is classified as custom C2 with `recoveredIocCount` 8. The attacker model is a publisher-operated mass-subscription campaign that abuses the installer's own WhatsApp account, matching the OSV advisory's described behavior and corroborated by the `entrypoint` console branding plus hidden domains like `updatedCreds.me` and `.profile` persistence probes. Given the strong obfuscation plus recovered network indicators and the explicit malicious workflow, this should be treated as confirmed malware and submitted. ENTRY lib/index.js (main: ./lib/index.js) PERSISTENCE - Startup Persistence in WAProto/index.js: ".profile" - Startup Persistence in lib/Socket/messages-send.js: ".profile" - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" DESTINATION - 5 exfil (custom-c2) - 3 fetched-payload (deobfuscated) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/generics.js: "Buffer.from(value?.data || value).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString("base64")" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString("base64")" - Network Request in lib/Utils/generics.js: "fetch("https:" OBFUSCATION - Decoded Base64 Content in lib/Utils/messages-media.js (x2) - Decoded Base64 Content in [deobfuscated] lib/Utils/messages-media.js (x2) - IOCs Found in Deobfuscated Code in lib/Socket/socket.js - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, "base64")" - Dynamic Base64 Decoding in lib/Socket/socket.js: "Buffer.from(str, "base64")" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, "base64")" - Dynamic Base64 Decoding in lib/Utils/messages-media.js: "Buffer.from(encoded, "base64")" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, "base64")" (+9 more) PAYLOAD FILES lib/Utils/messages-media.js (+ [deobfuscated] lib/Utils/messages-media.js, lib/Socket/socket.js)