asistenyorstore@8.0.14

Summary

This Baileys fork adds two undocumented code paths that use the installer's authenticated WhatsApp session to auto-follow newsletters controlled by the package author. In lib/Socket/socket.js, socketConnect() reconstructs a URL from a String.fromCharCode integer array that decodes to https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json, fetches a JSON list, and 200 seconds later issues w:mex IQ queries (query_id 7871414976211147) that follow each newsletter id under the caller's account. In lib/Utils/messages-media.js, loadBase() is wired into makeNewsletterSocket and, on a setTimeout, base64-decodes a second URL (https://raw.githubusercontent.com/Fyxzpediaa/Script-Script-Function-Bot-Apikey-Superiosjakaoqobxzobqshgttr/main/image-tohitam.json) and calls newsletterWMexQuery(item.id, QueryIds.FOLLOW) on each entry. A third XOR/base64 constant decodes to '@newsletter'. The remote lists are author-mutable, so the set of channels the installer's account follows can be changed at any time without a package update. No installer credentials, environment variables, filesystem contents, or messages are exfiltrated, and no remote code is fetched and executed.

Source: amazon-inspector (af7e0a6300cbca6ace27dd4e4f5e296c6970c3b01a26022b185fe5423b37483d)