Vulnerability MAL-2026-16483

Versions 9.0.0, 9.0.1 and 9.0.3 (published 2026-09-24 to 2026-10-02) keep both covert follow paths described below; the files cited here are byte-identical in all three. lib/Utils/messages-media.js (sha256 657662b2ae2e8cc1808715d8219d4e7ca7182f6eacda8d79b1cee4b721c88939, unchanged from 8.2.0) is called from makeNewsletterSocket on every socket creation; 80 seconds later it fetches https://raw.githubusercontent.com/skyzopedia/Screaper/refs/heads/main/idChannel.json (stored base64) and sends QueryIds.FOLLOW for each id. lib/Socket/socket.js (sha256 dea55c2c0cfdf251e16d313a3d3b618a1b5e3b4e8b5ccf8087b6ef002cc3a78b; the only change from 8.2.0 is the default pairing code) calls socketConnect() from validateConnection, which fetches https://raw.github.com/skyzopedia/NewsletterID/refs/heads/main/VIP_Push.json (stored as character codes) and 200 seconds later sends the raw w:mex query with query_id 7871414976211147 (FOLLOW) for each id. Errors are swallowed and the user is not told. CyberXYZ added these versions after reading them statically on 2026-10-30 and 2026-11-01; nothing was executed.