Malicious code in my-auto-follow (npm)
The npm package my-auto-follow contains malicious code that silently auto-follows WhatsApp newsletters from an attacker-controlled list without user consent. The package also depends on a separate malicious libsignal patcher. This is part of an ongoing DGXeon campaign with related malicious packages already documented.
- Disclosed
- Last updated
- Blast radius
- All users of my-auto-follow npm package who establish WhatsApp sessions
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- my-auto-follow · 1.0.3
- @dreamguyxeon/libsignal-node · 1.0.1
The npm package my-auto-follow, a Baileys WhatsApp Web API fork, contains embedded malicious code that performs undisclosed, remote-controlled newsletter auto-follow behavior. After a session is established, the code waits 120 seconds, then fetches a JSON list of WhatsApp newsletter JIDs from an attacker-controlled GitHub repository (https://raw.githubusercontent.com/DGXeon13/strings/refs/heads/main/strings.json) and silently issues follow commands for each entry with errors suppressed.
The malicious behavior is triggered at runtime through the normal socket initialization path (makeNewsletterSocket), not during installation. There is no user opt-in or disclosure of this functionality. The package also depends on a separate malicious patcher via npm alias npm:@dreamguyxeon/libsignal-node@1.0.1.
This incident is part of a broader DGXeon campaign; related malicious packages dgxeon-baileys (MAL-2026-2252) and baileys-dgxeon (MAL-2025-806) are already documented in OSV. The tarball SHA256 for version 1.0.3 is 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68.
Indicators of compromise
- Packages
- my-auto-follow
- @dreamguyxeon/libsignal-node
- Domains
- raw.githubusercontent.com
- Hashes
- 1332d396a2251692c2654fca52620a433a880551500a567ade040e8f01440e68
Remediation
- Immediately uninstall my-auto-follow from all projects
- Remove any dependencies on @dreamguyxeon/libsignal-node
- Audit npm package.json and lock files for presence of my-auto-follow or related DGXeon packages
- Use a legitimate WhatsApp API library or fork instead
- Review npm audit logs for installation of this package
- Monitor for unauthorized WhatsApp newsletter follows on affected accounts
Sources
- GitHub Advisory GHSA-f768-qx25-62gf · GitHub Advisory Database
Cite this entry
"Malicious code in my-auto-follow (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-my-auto-follow-npm-1mue4h
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @mohamed_nowisar/token3-check (npm)
The npm package @mohamed_nowisar/token3-check contained malicious code in preinstall, install, and postinstall lifecycle hooks that exfiltrated system and CI environment information to a third-party webhook endpoint without user consent.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in agora402-payment-utils (npm)
The npm package agora402-payment-utils contains malicious code that replaces caller-supplied recipient addresses with a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08) in payment routing functions. Additionally, a postinstall script exfiltrates installer metadata to an external webhook without consent.
npmCompromised packageMalicious commit - containedcritical
Malicious code in commandor-cli (npm)
commandor-cli@1.0.0 on npm contains malicious postinstall script that downloads and executes a binary from an attacker-controlled GitHub repository. The script also beacons installation metadata to a command-and-control server and includes a PowerShell bridge to extend execution to Windows hosts on WSL systems.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-thread (npm)
The npm package mutex-thread contained injected malicious code that spawns obfuscated dropper payloads, exfiltrates host reconnaissance data to Slack and Telegram, and executes remotely-controlled commands fetched from an Ethereum smart contract on Sepolia testnet.
npmCompromised packageMalicious commit