my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled, consentless newsletter auto-follow behavior. Specifically, after a WhatsApp session is established, the library waits 120 seconds and fetches a JSON list of WhatsApp newsletter JIDs from an attacker-controlled GitHub URL. It then silently issues follow commands for each listed channel ID without any user prompt or opt-in. The fetched list is mutable and can be changed at any time by the attacker without republishing the package, enabling dynamic control over which channels are followed. This compromises the social graph of the authenticated WhatsApp account using the library. The malicious behavior is triggered at runtime via the makeNewsletterSocket function and affects versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3. There is no official patch or remediation information available.

Any developer using my-auto-follow versions 1.0.0 through 1.0.3 to power a WhatsApp bot will have their authenticated WhatsApp account silently issue follow commands to attacker-chosen newsletter channels. This results in unauthorized actions performed in the context of the user's WhatsApp identity, potentially manipulating the user's social graph and exposing them to privacy and reputational risks. The attacker can dynamically control which channels are followed by modifying the remote JSON list, without requiring republishing or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the my-auto-follow package and remove it from their projects. Review dependencies for this package and replace with a trusted alternative. Monitor for updates from the package maintainer or security advisories for remediation.