MAL-2026-15819 Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures() function (line 230) that is scheduled with setTimeout(() => startAutoFeatures(fullSock), 0) at socket construction (line 255), unconditionally and with no API surface exposing it. It fetches https://raw.githubusercontent.com/travatiger/MrLegend/refs/heads/main/Chids.json (line 236), parses the response as a list of channel ids, and calls sockInstance.newsletterFollow(id) for each one (line 246) on the caller's authenticated session, stepping through the list every 10 seconds (FOLLOW_INTERVAL = 10000, line 232). Because the list is fetched from a GitHub repository at run time, targeting can be changed without a new package release. Diffing lib/Socket against upstream @whiskeysockets/baileys 7.0.0-rc14 confirms this block has no upstream equivalent; the install-time scripts (engine-requirements.js, WAProto/compiler.js) are identical to upstream and are not the malicious surface. Versions 1.2.4 and 1.2.5 carry a byte-identical lib/Socket/newsletter.js (sha256 ce758c152d280832677c6dc5048832bad61b4f9391b3f33b0e3e02b12f023ded); tarball sha256 a746711435f15237c5f2cb08134937f1260a807f2356509fc8bc92db15d304e9 (1.2.4) and fd2c510df110af2122551b7fa56a3e0d42f20f43f7c9f4b8135afddef33065c0 (1.2.5). This is the same WhatsApp newsletter auto-follow campaign reported in MAL-2026-13929 and MAL-2026-13932. Two independent static reviews by pkgwarden reached the same conclusion; the package was not executed and the control URL was not requested.