Malicious code in luoxy-baileys (npm)

The luoxy-baileys package (versions 7.1.1, 7.1.2, and 7.1.3) unconditionally triggers an auto-follow feature that, 90 seconds after establishing a WhatsApp Web socket connection, sends 'w:mex' FOLLOW IQ stanzas to subscribe the user's WhatsApp account to specific newsletter channels. The default configuration enables this behavior without user notification. The channels include a hardcoded newsletter JID and additional JIDs fetched at runtime from a GitHub raw URL controlled by the publisher, allowing dynamic updates to the subscription list post-installation. Static analysis confirms no exfiltration of WhatsApp credentials or session keys, no install-time payload, and no persistence mechanisms. The primary impact is unauthorized use of the victim's WhatsApp account to inflate subscriber counts for the publisher’s channels.

The malicious code causes the victim's WhatsApp account to subscribe to publisher-chosen WhatsApp Channels without consent, potentially misleading channel subscriber metrics. There is no evidence of credential theft, data exfiltration, or persistent backdoors. The impact is limited to covertly using the victim's authenticated session to perform these subscriptions, which may violate user trust and platform policies.

Users should avoid using the luoxy-baileys package versions 7.1.1, 7.1.2, and 7.1.3. If usage is necessary, explicitly disable the auto-follow feature by setting 'autoFollowNewsletterOnConnect' to false in the connection configuration. Monitor for updates or alternative packages without this behavior. Patch status is not confirmed; check the vendor or package repository for any official fixes or updates.