my-auto-follow (1.0.3) potentially affected by unknown CVE via @dreamguyxeon/libsignal-node (1.0.1)

@dreamguyxeon/libsignal-node NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @dreamguyxeon/libsignal-node and may be impacted: - my-auto-follow 1.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-DREAMGUYXEONLIBSIGNALNODE-18748591...

my-auto-follow (1.0.3) potentially affected by unknown CVE via @dreamguyxeon/libsignal-node (1.0.1)

@dreamguyxeon/libsignal-node NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @dreamguyxeon/libsignal-node and may be impacted: - my-auto-follow 1.0.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13931...

Malicious code in my-auto-follow (npm)

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...

MAL-2026-13932 Malicious code in my-auto-follow (npm)

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...