MAL-2026-13932

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/my-auto-follow/MAL-2026-13932.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13932

Published

2026-08-10T22:30:00Z

Modified

2026-08-14T15:00:53Z

Summary

Malicious code in my-auto-follow (npm)

Details

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (attacker-controlled; observed contents include newsletter JIDs), and silently issues newsletterWMexQuery(..., QueryIds.FOLLOW) for each entry with errors swallowed. There is no caller opt-in. Trigger is runtime (makeNewsletterSocket / normal socket path), not install: preinstall only checks Node >= 20. The package also depends on libsignal via the npm alias npm:@dreamguyxeon/libsignal-node@1.0.1 (separate malicious patcher reported alongside this entry). Related DGXeon campaign packages already in OSV include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806). Tarball sha256 for 1.0.3: 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b)

my-auto-follow is a Baileys WhatsApp library fork whose makeWASocket newsletter socket schedules an undocumented setTimeout (120s after socket creation) that fetches a remote JSON list from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json and unconditionally force-follows every channel ID in that list via newsletterWMexQuery(id, QueryIds.FOLLOW) (lib/Socket/newsletter.js lines 100-122). The fetched list is hosted on a mutable branch under the package author's GitHub account and can be changed at any time without republishing the package. There is no opt-in, no documentation, and no user prompt. Any developer who uses this library to power a WhatsApp bot will have their authenticated WhatsApp account silently issue FOLLOW commands to whatever channel IDs the author chooses to publish — abusing the installer's WhatsApp identity for the author's social-graph manipulation. The behavior matches the package name my-auto-follow but is never disclosed to the consumer.

Database specific

{
    "iocs": {
        "urls": [
            "https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json",
            "https://raw.githubusercontent.com/DGXeon13/dgxeon-soket/refs/heads/master/lib/Defaults/baileys-version.json"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017625",
            "import_time": "2026-08-13T15:26:42.949508295Z",
            "modified_time": "2026-08-13T14:58:32Z",
            "sha256": "481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-017860",
            "import_time": "2026-08-14T14:51:43.55760879Z",
            "modified_time": "2026-08-14T14:47:04Z",
            "sha256": "008cd485a606d24837302f258618d5e1c72e9d0e11d69092fead140a1b22c00a",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017858",
            "import_time": "2026-08-14T14:51:43.432762493Z",
            "modified_time": "2026-08-14T14:46:47Z",
            "sha256": "c759189fdb4a0a25b69a60e1f2ff6599c7bbaeee45b93c3f38ac719cbf7e954d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- pkgwarden - FINDER
- - https://pkgwarden.com

Affected packages

npm / my-auto-follow

Package

Name: my-auto-follow; View open source insights on deps.dev
Purl: pkg:npm/my-auto-follow

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "lib/Socket/newsletter.js",
            "sha256": "d46c64f770bf6f1d7220deb9c9d38e842ba022b8cd95cda654705ba8297e9abb",
            "tlsh": "c452965665fa5aa517a37054e67fb0e0b320f243782598673f8cd4020f4a1dde8b3bd8"
        }
    ],
    "package_integrity": [
        {
            "filename": "my-auto-follow-1.0.1.tgz",
            "hashes": {
                "sha1": "523cea099503a17fae0b5653b7fef4f926e4f46b",
                "sha512_sri": "sha512-7xGrtS/lXbuciZoqkW13N30+XLU9oYUiwmvHG0scisLMFKtc3/KWXkPd6EMgBqzVRMBWed/Kc8c/EQYWuxD/4A=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/my-auto-follow/MAL-2026-13932.json"