GCVE-110-OSM-2026-2719

This malicious NPM package is built for follower-farming / social-boost botnet, and is not a data stealer. Payload: src/session_record.js 1. index.js:14-23 — on require(), schedules install.js to run 1s later (no postinstall hook; triggered at runtime import). 2. install.js:findBaileysPath() — hunts for @whiskeysockets/baileys or @shenira/baileys in parent node_modules. 3. install.js:428 — overwrites baileys/lib/Socket/newsletter.js with attacker's version, then force-exits the host process after 20s (install.js:434-438). 4. Drops node_modules/.cache with sentinel content "Iove" to skip re-patching. C2 / Payload pull - second stage payload: https://raw.githubusercontent.com/sanndestroyer/destroyerbail/refs/heads/main/x.json (install.js:142) — a list of WhatsApp newsletter and channel IDs. - After a 120-second delay, iterates the list and calls newsletterWMexQuery(id, QueryIds.FOLLOW) every 11s (install.js:139-164). Exfiltration - No credential / file / token exfil. No outbound POST of victim data. - Impact is victim-side abuse: hijacks the victim's logged-in WhatsApp session (via Baileys) to auto-follow attacker-controlled WhatsApp newsletters, inflating subscriber counts. Targeting Only fires if @whiskeysockets/baileys or @shenira/baileys is resolvable — targets WhatsApp bot developers specifically Key findings: - Dynamic Base64 Decoding in src/session_record.js: "Buffer.from(k, 'base64')" - Brand New Package - Very New NPM Publisher Account IOCs: - payloadFileHash: 660681665627de50bb1de59c07619f96829fe1db84c6568c60de35e6361d9d47