my-auto-follow

GHSA-f768-qx25-62gf

Malicious code in my-auto-follow (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (attacker-controlled; observed contents include newsletter JIDs), and silently issues newsletterWMexQuery(..., QueryIds.FOLLOW) for each entry with errors swallowed. There is no caller opt-in. Trigger is runtime (makeNewsletterSocket / normal socket path), not install: preinstall only checks Node >= 20. The package also depends on libsignal via the npm alias npm:@dreamguyxeon/[email protected] (separate malicious patcher reported alongside this entry). Related DGXeon campaign packages already in OSV include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806). Tarball sha256 for 1.0.3: 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d26b2fc9f93809d54adfeb36ac5579fcda97c46d/osv/malicious/npm/my-auto-follow/MAL-2026-13932.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d26b2fc9f93809d54adfeb36ac5579fcda97c46d/osv/malicious/npm/my-auto-follow/MAL-2026-13932.json
- https://osv.dev/vulnerability/MAL-2025-806
- https://osv.dev/vulnerability/MAL-2026-2252
- https://safedep.io/malicious-baileys-npm-whatsapp-campaign
- https://www.npmjs.com/package/my-auto-follow
- https://github.com/ossf/malicious-packages/blob/9ed081e7b0247038841ccd64abfe7655c55246f1/osv/malicious/npm/my-auto-follow/MAL-2026-13932.json
- https://www.npmjs.com/package/my-auto-follow/v/1.0.1
- https://github.com/ossf/malicious-packages/blob/3594b5dd79f32f3149880c70b70bfc0e64b7245a/osv/malicious/npm/my-auto-follow/MAL-2026-13932.json

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.