MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)

This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect() reconstructs a URL from a char-code array (decoding to https://raw.githubusercontent.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json), fetches a JSON list from that mutable GitHub branch, and 200 seconds after connect iterates the list issuing authenticated w:mex queries with query_id 7871414976211147 (QueryIds.FOLLOW) against the installer's own WhatsApp session. A separate exported helper generateMessageV decodes a base64+XOR(key=23)-obfuscated string to a hardcoded <digits>@newsletter JID and invokes the same FOLLOW query. The obfuscation of both the URL (char-code array) and the JID literal (base64+XOR) exists solely to hide these targets from source review; upstream Baileys does not contain this code path. The runtime dependency @whiskeysockets/eslint-config is also declared as a mutable GitHub tarball reference (github:whiskeysockets/eslint-config) rather than a pinned registry range, so npm install resolves it to whatever that repository's default branch currently contains. The covert action uses the installer's authenticated identity to gain reach for author-chosen newsletter IDs but does not exfiltrate credentials, install persistence, or execute remote code on the installer's host; the harm is loss of control over the installer's WhatsApp account actions, not machine compromise.