Malicious code in my-auto-follow (npm)
npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (attacker-controlled; observed contents include newsletter JIDs), and silently issues newsletterWMexQuery(..., QueryIds.FOLLOW) for each entry with errors swallowed. There is no caller opt-in. Trigger is runtime (makeNewsletterSocket / normal socket path), not install: preinstall only checks Node >= 20. The package also depends on libsignal via the npm alias npm:@dreamguyxeon/[email protected] (separate malicious patcher reported alongside this entry). Related DGXeon campaign packages already in OSV include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806). Tarball sha256 for 1.0.3: 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b) my-auto-follow is a Baileys WhatsApp library fork whose `makeWASocket` newsletter socket schedules an undocumented setTimeout (120s after socket creation) that fetches a remote JSON list from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json and unconditionally force-follows every channel ID in that list via `newsletterWMexQuery(id, QueryIds.FOLLOW)` (lib/Socket/newsletter.js lines 100-122). The fetched list is hosted on a mutable branch under the package author's GitHub account and can be changed at any time without republishing the package. There is no opt-in, no documentation, and no user prompt. Any developer who uses this library to power a WhatsApp bot will have their authenticated WhatsApp account silently issue FOLLOW commands to whatever channel IDs the author chooses to publish — abusing the installer's WhatsApp identity for the author's social-graph manipulation. The behavior matches the package name `my-auto-follow` but is never disclosed to the consumer.
AI Analysis
Technical Summary
my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled, consentless newsletter auto-follow behavior. Specifically, after a WhatsApp session is established, the library waits 120 seconds and fetches a JSON list of WhatsApp newsletter JIDs from an attacker-controlled GitHub URL. It then silently issues follow commands for each listed channel ID without any user prompt or opt-in. The fetched list is mutable and can be changed at any time by the attacker without republishing the package, enabling dynamic control over which channels are followed. This compromises the social graph of the authenticated WhatsApp account using the library. The malicious behavior is triggered at runtime via the makeNewsletterSocket function and affects versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3. There is no official patch or remediation information available.
Potential Impact
Any developer using my-auto-follow versions 1.0.0 through 1.0.3 to power a WhatsApp bot will have their authenticated WhatsApp account silently issue follow commands to attacker-chosen newsletter channels. This results in unauthorized actions performed in the context of the user's WhatsApp identity, potentially manipulating the user's social graph and exposing them to privacy and reputational risks. The attacker can dynamically control which channels are followed by modifying the remote JSON list, without requiring republishing or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the my-auto-follow package and remove it from their projects. Review dependencies for this package and replace with a trusted alternative. Monitor for updates from the package maintainer or security advisories for remediation.
Malicious code in my-auto-follow (npm)
Description
npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (attacker-controlled; observed contents include newsletter JIDs), and silently issues newsletterWMexQuery(..., QueryIds.FOLLOW) for each entry with errors swallowed. There is no caller opt-in. Trigger is runtime (makeNewsletterSocket / normal socket path), not install: preinstall only checks Node >= 20. The package also depends on libsignal via the npm alias npm:@dreamguyxeon/[email protected] (separate malicious patcher reported alongside this entry). Related DGXeon campaign packages already in OSV include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806). Tarball sha256 for 1.0.3: 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b) my-auto-follow is a Baileys WhatsApp library fork whose `makeWASocket` newsletter socket schedules an undocumented setTimeout (120s after socket creation) that fetches a remote JSON list from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json and unconditionally force-follows every channel ID in that list via `newsletterWMexQuery(id, QueryIds.FOLLOW)` (lib/Socket/newsletter.js lines 100-122). The fetched list is hosted on a mutable branch under the package author's GitHub account and can be changed at any time without republishing the package. There is no opt-in, no documentation, and no user prompt. Any developer who uses this library to power a WhatsApp bot will have their authenticated WhatsApp account silently issue FOLLOW commands to whatever channel IDs the author chooses to publish — abusing the installer's WhatsApp identity for the author's social-graph manipulation. The behavior matches the package name `my-auto-follow` but is never disclosed to the consumer.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled, consentless newsletter auto-follow behavior. Specifically, after a WhatsApp session is established, the library waits 120 seconds and fetches a JSON list of WhatsApp newsletter JIDs from an attacker-controlled GitHub URL. It then silently issues follow commands for each listed channel ID without any user prompt or opt-in. The fetched list is mutable and can be changed at any time by the attacker without republishing the package, enabling dynamic control over which channels are followed. This compromises the social graph of the authenticated WhatsApp account using the library. The malicious behavior is triggered at runtime via the makeNewsletterSocket function and affects versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3. There is no official patch or remediation information available.
Potential Impact
Any developer using my-auto-follow versions 1.0.0 through 1.0.3 to power a WhatsApp bot will have their authenticated WhatsApp account silently issue follow commands to attacker-chosen newsletter channels. This results in unauthorized actions performed in the context of the user's WhatsApp identity, potentially manipulating the user's social graph and exposing them to privacy and reputational risks. The attacker can dynamically control which channels are followed by modifying the remote JSON list, without requiring republishing or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the my-auto-follow package and remove it from their projects. Review dependencies for this package and replace with a trusted alternative. Monitor for updates from the package maintainer or security advisories for remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13932
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7e036abf8831d5398f8ac5
Added to database: 08/13/2026, 17:48:26 UTC
Last enriched: 08/13/2026, 18:06:48 UTC
Last updated: 09/25/2026, 06:03:27 UTC
Views: 31
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.