registry / my-auto-follow / 1.0.3

my-auto-follow@1.0.3

dgxeon13

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Runtime socket construction schedules hidden automated account actions. It retrieves attacker-controlled channel IDs and follows them using the authenticated WhatsApp session.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Application calls the package's exported makeWASocket constructor.

Impact

Mutates the user's WhatsApp subscriptions to arbitrarily chosen channels.

Mechanism

remote-controlled silent WhatsApp newsletter auto-follow

Attack narrative

On normal socket construction, the package waits two minutes, downloads a mutable list from the author's GitHub repository, then issues authenticated WhatsApp FOLLOW queries for each supplied ID. The behavior is non-configurable, hidden behind delayed timers, and suppresses errors while the remote list can change at any time.

Rationale

This is a concrete, unconsented remote-controlled mutation of the consumer's authenticated WhatsApp account, not package-aligned messaging functionality. The install hook itself is benign, but runtime behavior is malicious.

Evidence

lib/Socket/newsletter.jslib/Socket/messages-send.jslib/Socket/messages-recv.jslib/Socket/index.jspackage.jsonengine-requirements.jslib/index.js

Network endpoints2

raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13932

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in my-auto-follow (npm)

Details

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (attacker-controlled; observed contents include newsletter JIDs), and silently issues newsletterWMexQuery(..., QueryIds.FOLLOW) for each entry with errors swallowed. There is no caller opt-in. Trigger is runtime (makeNewsletterSocket / normal socket path), not install: preinstall only checks Node >= 20. The package also depends on libsignal via the npm alias npm:@dreamguyxeon/libsignal-node@1.0.1 (separate malicious patcher reported alongside this entry). Related DGXeon campaign packages already in OSV include dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806). Tarball sha256 for 1.0.3: 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68. --- ## Source: amazon-inspector (481bdecc52b4f32afcfd2e6755ef8c74191cc0010714a0403aa93d1bd958369b) my-auto-follow is a Baileys WhatsApp library fork whose `makeWASocket` newsletter socket schedules an undocumented setTimeout (120s after socket creation) that fetches a remote JSON list from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json and unconditionally force-follows every channel ID in that list via `newsletterWMexQuery(id, QueryIds.FOLLOW)` (lib/Socket/newsletter.js lines 100-122). The fetched list is hosted on a mutable branch under the package author's GitHub account and can be changed at any time without republishing the package. There is no opt-in, no documentation, and no user prompt. Any developer who uses this library to power a WhatsApp bot will have their authenticated WhatsApp account silently issue FOLLOW commands to whatever channel IDs the author chooses to publish — abusing the installer's WhatsApp identity for the author's social-graph manipulation. The behavior matches the package name `my-auto-follow` but is never disclosed to the consumer.

References

OSV advisory

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

lib/Socket/newsletter.js fetches an author-controlled remote JSON list.
It silently follows every remote-supplied newsletter ID after a 120-second delay.
Follow requests are repeated every 11 seconds and errors are suppressed.
Public makeWASocket reaches makeMessagesSocket, which constructs this newsletter layer.

Evidence against

package.json preinstall only checks the Node major version.
No credential-file harvesting or local persistence was found in inspected paths.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

GitDependency

scanned 96 file(s), 1.38 MB of source, external domains: faq.whatsapp.com, raw.githubusercontent.com, v.whatsapp.net, web.whatsapp.com

Oversized source lightweight scan

Source & flagged code

4 flagged

package.jsonView file

Lines 19-59json

19 "types": "lib/index.d.ts",

20 "directories": {

21 "lib": "lib"

22 },

23 "files": [

24 "lib/*",

25 "WAProto/*.js",

26 "engine-requirements.js"

27 ],

28 "scripts": {

29 "build:all": "tsc && typedoc",

30 "build:docs": "typedoc",

31 "build:tsc": "tsc",

32 "changelog:last": "conventional-changelog -p angular -r 2",

33 "changelog:preview": "conventional-changelog -p angular -u",

34 "gen:protobuf": "sh WAProto/GenerateStatics.sh",

35 "lint": "eslint src --ext .js,.ts,.jsx,.tsx",

36 "lint:fix": "eslint src --fix --ext .js,.ts,.jsx,.tsx",

37 "prepack": "",

38 "prepare": "",

39 "preinstall": "node ./engine-requirements.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

40 "release": "release-it",

41 "test": "jest"

42 },

43 "dependencies": {

44 "@adiwajshing/keyed-db": "^0.2.4",

45 "@hapi/boom": "^9.1.3",

46 "@cacheable/node-cache": "^1.4.0",

47 "async-mutex": "^0.5.0",

48 "audio-decode": "^2.1.3",

49 "axios": "^1.3.3",

50 "cache-manager": "4.0.1",

51 "chalk": "^4.1.2",

52 "futoin-hkdf": "^1.5.1",

53 "libphonenumber-js": "^1.10.20",

54 "lodash": "^4.17.21",

55 "libsignal": "npm:@dreamguyxeon/libsignal-node@1.0.1",

56 "music-metadata": "^7.12.3",

57 "node-cache": "^5.1.2",

58 "node-fetch": "^2.6.1",

59 "pino": "^7.0.0",

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = normalized_sha256 matchedPackage = @dreamguyxeon/baileyx@2.0.0 matchedPath = lib/Utils/messages-media.js matchedIdentity = npm:QGRyZWFtZ3V5eGVvbi9iYWlsZXl4:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

lib/Utils/messages.jsView file

•matchType = normalized_sha256 matchedPackage = @dreamguyxeon/baileyx@2.0.0 matchedPath = lib/Utils/messages.js matchedIdentity = npm:QGRyZWFtZ3V5eGVvbi9iYWlsZXl4:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/Utils/messages.jsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./engine-requirements.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8472622 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/messages-media.jsView file

Findings

3 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritylib/Utils/messages-media.js

HighKnown Malware Source Similaritylib/Utils/messages.js

MediumNetwork

MediumOversized Source FileWAProto/index.js

MediumStructural Risk Force Deep Review

MediumGit Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings