my-auto-follow

{"schema_version":"1.7.4","id":"MAL-2026-13932","published":"2026-08-10T22:30:00Z","modified":"2026-08-14T14:53:30.966931400Z","summary":"Malicious code in my-auto-follow (npm)","details":"npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (attacker-controlled; observed contents include newsletter JIDs), and silently issues newsletterWMexQuery(..., QueryIds.FOLLOW) for each entry with errors swallowed. There is no caller opt-in. Trigger is runtime (makeNewsletterSocket / normal socket path), not install: preinstall only checks Node >= 20. The package also depends on libsignal via the npm alias npm:@dreamguyxeon/libsignal-node@1.0.1 (separate malicious patcher reported alongside this entry). Related DGXeon campaign packages already in OSV include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806). Tarball sha256 for 1.0.3: 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b)\nmy-auto-follow is a Baileys WhatsApp library fork whose `makeWASocket` newsletter socket schedules an undocumented setTimeout (120s after socket creation) that fetches a remote JSON list from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json and unconditionally force-follows every channel ID in that list via `newsletterWMexQuery(id, QueryIds.FOLLOW)` (lib/Socket/newsletter.js lines 100-122). The fetched list is hosted on a mutable branch under the package author's GitHub account and can be changed at any time without republishing the package. There is no opt-in, no documentation, and no user prompt. Any developer who uses this library to power a WhatsApp bot will have their authenticated WhatsApp account silently issue FOLLOW commands to whatever channel IDs the author chooses to publish — abusing the installer's WhatsApp identity for the author's social-graph manipulation. The behavior matches the package name `my-auto-follow` but is never disclosed to the consumer.\n","affected":[{"package":{"name":"my-auto-follow","ecosystem":"npm"},"versions":["1.0.0","1.0.1","1.0.2","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/Socket/newsletter.js","sha256":"d46c64f770bf6f1d7220deb9c9d38e842ba022b8cd95cda654705ba8297e9abb","tlsh":"c452965665fa5aa517a37054e67fb0e0b320f243782598673f8cd4020f4a1dde8b3bd8"}],"package_integrity":[{"filename":"my-auto-follow-1.0.1.tgz","hashes":{"sha1":"523cea099503a17fae0b5653b7fef4f926e4f46b","sha512_sri":"sha512-7xGrtS/lXbuciZoqkW13N30+XLU9oYUiwmvHG0scisLMFKtc3/KWXkPd6EMgBqzVRMBWed/Kc8c/EQYWuxD/4A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/my-auto-follow"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2026-2252"},{"type":"ADVISORY","url":"https://osv.dev/vulnerability/MAL-2025-806"},{"type":"WEB","url":"https://safedep.io/malicious-baileys-npm-whatsapp-campaign/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/my-auto-follow/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/my-auto-follow/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/my-auto-follow/v/1.0.3"}],"database_specific":{"iocs":{"urls":["https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json","https://raw.githubusercontent.com/DGXeon13/dgxeon-soket/refs/heads/master/lib/Defaults/baileys-version.json"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-017625","import_time":"2026-08-13T15:26:42.949508295Z","modified_time":"2026-08-13T14:58:32Z","sha256":"481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017860","import_time":"2026-08-14T14:51:43.55760879Z","modified_time":"2026-08-14T14:47:04Z","sha256":"008cd485a606d24837302f258618d5e1c72e9d0e11d69092fead140a1b22c00a","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017858","import_time":"2026-08-14T14:51:43.432762493Z","modified_time":"2026-08-14T14:46:47Z","sha256":"c759189fdb4a0a25b69a60e1f2ff6599c7bbaeee45b93c3f38ac719cbf7e954d","source":"amazon-inspector","versions":["1.0.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"pkgwarden","contact":["https://pkgwarden.com"],"type":"FINDER"}]}