MAL-2026-15918

@modss/baileys is a renamed fork of the Baileys WhatsApp Web library published 2026-09-01 and 2026-09-02 under a scope created the same day. lib/Socket/newsletter.js sets NEWSLETTER_LIST_URL to https://raw.githubusercontent.com/Dayyy-19/Anu/main/Newsletter.json. On every connection.update with connection === 'open', autoFollowConfiguredNewsletters() fetches that list and issues an executeWMexQuery FOLLOW for each id on the user's own authenticated WhatsApp session, caching followed ids in session/followed-newsletters.json. An Indonesian comment in the file explains that the list lives on GitHub so channels can be added or removed without redeploying the code, i.e. the follow targets are publisher-controlled at runtime. All three published versions carry the identical handler. The package also aliases its libsignal dependency to @modss/libsignal, which pkgwarden read as a plain rename with no malicious content. No credential or session-key theft was observed, and the dead-drop URL was not requested by pkgwarden. All versions were fetched from the npm registry and read by hand on 2026-09-03. Same remote-dead-drop shape as MAL-2026-15819 (@mrlegendbot/baileys) and MAL-2026-13932 (my-auto-follow).