GCVE-110-OSM-2026-7241

This package is a trojanized fork of the popular @whiskeysockets/baileys WhatsApp library, published by a brand-new single-package npm account. The most critical finding is a base64-encoded URL `https://files.gifted.co.ke/file/chJids.json` hidden inside `lib/Socket/newsletter.js` — a third-party Kenyan file-hosting domain with no legitimate relationship to the WhatsApp protocol, embedded covertly to evade naive source review. The deobfuscator also extracted hidden IOCs from `lib/Utils/generics.js`, and the applied combo flags ('hidden-iocs', 'obfuscated-exfil', 'deobfuscated-malware') indicate the static engine found active concealment, not just protocol boilerplate. Most base64/encoding findings in the crypto and media files are false positives inherent to the Signal protocol implementation, but the newsletter.js hidden URL is inconsistent with any legitimate WhatsApp functionality and is consistent with a remote configuration or secondary payload fetch pattern typical of trojanized open-source library attacks. The 'malicious-dependency' flag on axios and the 'startup-persistence' hit on .profile in messages-send.js are likely false positives, but the hidden external URL alone — combined with a new publisher and copied popular library structure — meets the threshold for malicious. ENTRY lib/index.js (main: lib/index.js) PERSISTENCE - Startup Persistence in lib/Socket/messages-send.js: ".profile" DESTINATION - custom-c2: https://mmg.whatsapp.net/ (primary, plaintext) in lib/Utils/messages-media.js - custom-c2: update.me (plaintext) in lib/Socket/socket.js - custom-c2: mmg.whatsapp.net (plaintext) in lib/Utils/messages-media.js - bitcoinAddresses: 123456789ABCDEFGHJKLMNPQRSTVWXYZ (exfil, plaintext) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" OBFUSCATION - Decoded Base64 Content in lib/Socket/newsletter.js - IOCs Found in Deobfuscated Code in lib/Utils/generics.js - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: "Buffer.from(advSecretKey, 'base64')" - String Array Obfuscation in lib/WABinary/constants.js: "[ '1724', 'profile_picture', '1071', '1314', '1605', '407', '990', '1710', '746'..." (+5 more) ADDITIONAL FINDINGS - Shell Command Execution in lib/Utils/messages-media.js: "require("child_process")" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/Socket/newsletter.js (+ lib/Utils/generics.js, lib/Utils/chat-utils.js) INDICATORS (IOCs) - urls: https://files.gifted.co.ke/file/chJids.json - domains: sock.ws, creds.me, whatsapp.net, mmg-fallback.whatsapp.net, files.gifted.co - emails: id@g.us, 16505361212@c.us, server@c.us, 0@c.us, 13135550002@c.us - payloadFileHash: 9db1b2abc244aad4b6350f584e9a5f888f8344a10b62c466150ea9d9fb7b7334