my-auto-follow@1.0.7
Vulnerability report · Last retrieved from osv.dev September 23, 2026 at 3:52 AM UTC
OSV ID
MAL-2026-13932
Ecosystem
npm
Summary
my-auto-follow@1.0.6 is a Baileys WhatsApp library fork with two installer-affecting behaviors. First, package.json declares the dependency whatsapp-rust-bridge-baron as git+https://github.com/7ucg/whatsapp-rust-bridge.git with no commit SHA or tag pin; the tarball ships no bundled node_modules for it, so npm install resolves the git URL at install time and executes whatever code and lifecycle hooks the HEAD of that repository contains, entirely outside the installer's version pinning and integrity control. Second, makeNewsletterSocket in the package's default socket construction schedules a 120-second timer that fetches a channel-ID list from https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json (an unpinned mutable branch on a personal GitHub account) and issues WhatsApp newsletter FOLLOW queries for each ID using the caller's authenticated WhatsApp session, inflating the author's channel subscribers using the installer's identity. This behavior is not disclosed in README, and the target list can be changed remotely at any time by whoever controls that repository.
Source: amazon-inspector (983397af6686fd3a8ae5538fbc62139959592c3a7ac24c100055a57ed1fe8f05)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.