{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14764","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-05-11T08:01:30Z","dateUpdated":"2026-11-10T01:22:50Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"@danzxcode/danzx-bail is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/socket.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json (the URL itself stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).\n\nUpdate 2026-11-06: a second covert path, in 9.0.5, 9.0.6 and 9.0.7. lib/Utils/messages-media.js exports loadBase, which makeNewsletterSocket (lib/Socket/newsletter.js) calls on every socket creation as loadBase(newsletterWMexQuery, QueryIds). 80 seconds later it fetches a channel list from a URL stored as base64 and, 5 seconds apart, calls newsletterWMexQuery(id, QueryIds.FOLLOW) for each entry, swallowing errors and logging nothing. 9.0.5 and 9.0.6: lib/Utils/messages-media.js sha256 b41905238c3feaad4f8eae25b8cd7acea4ae94ec0916e404d9baadc2a49575fd, URL https://ch-danzx.vercel.app/lyyn. 9.0.7: sha256 cc4da072e185d0312ea0fb7ea0d08edbde8645b6a0218759dca8ab011a85ad59, URL https://danzx-bail.vercel.app/lyyn. 9.0.5 has only this path, so it is added to the affected versions. CyberXYZ read every published version statically from the npm registry tarballs on 2026-11-06 (integrity verified); nothing was executed. Amazon Inspector described the same loadBase loop in @rixxcodex/baileys (MAL-2026-16483).\n\nJudge assessment: This package is consistent with a covert attacker-controlled WhatsApp session hijack that silently follows channels using the victim's authenticated account, matching the disclosed MAL-2026-18816 behavior and the recovered exfil URL. The static evidence is not just generic obfuscation: `lib/Socket/socket.js` hides domains with char-code arrays and deobfuscation recovered `updatedCreds.me` plus `https://danzx-bail.vercel.app/lyyn`, while `messages-media.js` contains the same encoded channel-list fetch path. The presence of startup persistence attempts via `.profile` in multiple files, along with base64 encoding of credentials and media hashes, supports an attacker model of covert data collection and remote command/control rather than a normal WhatsApp API library. I would treat this as a malicious package published by the `danzxofficial` maintainer to abuse installed users' authenticated WhatsApp sessions.\n\nENTRY\n  lib/index.js (main: ./lib/index.js)\n\nPERSISTENCE\n  - Startup Persistence in WAProto/index.js: \".profile\"\n  - Startup Persistence in lib/Socket/messages-send.js: \".profile\"\n  - Startup Persistence in lib/Store/make-in-memory-store.js: \".profile\"\n\nDESTINATION\n  - 4 exfil (custom-c2)\n  - 3 fetched-payload (deobfuscated)\n  (values recorded in verified_iocs)\n\nEXFIL\n  - Data Encoding for Exfiltration in lib/Socket/socket.js: \"Buffer.from(creds.noiseKey.public).toString(\"base64\")\"\n  - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: \"Buffer.from(indexMac).toString(\"base64\")\"\n  - Data Encoding for Exfiltration in lib/Utils/generics.js: \"Buffer.from(value?.data || value).toString(\"base64\")\"\n  - Data Encoding for Exfiltration in lib/Utils/messages-media.js: \"Buffer.from(media.fileSha256).toString(\"base64\")\"\n  - Data Encoding for Exfiltration in lib/Utils/process-message.js: \"Buffer.from(keyId.keyId).toString(\"base64\")\"\n  - Network Request in lib/Utils/generics.js: \"fetch(\"https:\"\n\nOBFUSCATION\n  - Decoded Base64 Content in lib/Utils/messages-media.js\n  - Decoded Base64 Content in [deobfuscated] lib/Utils/messages-media.js\n  - IOCs Found in Deobfuscated Code in lib/Socket/socket.js\n  - Dynamic Base64 Decoding in lib/Socket/dugong.js: \"Buffer.from(jpegThumbnail, \"base64\")\"\n  - Dynamic Base64 Decoding in lib/Socket/socket.js: \"Buffer.from(str, \"base64\")\"\n  - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: \"Buffer.from(keyId, \"base64\")\"\n  - Dynamic Base64 Decoding in lib/Utils/messages-media.js: \"Buffer.from(encoded, \"base64\")\"\n  - Dynamic Base64 Decoding in lib/Utils/validate-connection.js: \"Buffer.from(advSecretKey, \"base64\")\"\n  (+9 more)\n\nPAYLOAD FILES\n  lib/Utils/messages-media.js (+ lib/Socket/socket.js, [deobfuscated] lib/Utils/messages-media.js)","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/ba177311-ff51-4942-ac22-445b6f0576ff","name":"Malicious npm package: @danzxcode/danzx-bail","tags":["advisory"]},{"url":"https://osv.dev/vulnerability/MAL-2026-18816","name":"","tags":["advisory"]},{"url":"https://registry.npmjs.org/@danzxcode/danzx-bail","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"@danzxcode/danzx-bail","collectionURL":"https://registry.npmjs.org","packageName":"@danzxcode/danzx-bail","repo":"","defaultStatus":"affected","versions":[{"version":"9.0.7","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["MAL-2026-18816"]}},"adp":null}}