Vulnerability MAL-2026-19022

turbo-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for a list downloaded at runtime from https://files.gifted.co.ke/file/chJids.json, https://turbo-cdns.vercel.app/files/turbowajids.json, https://www.image2url.com/r2/default/files/1780687002364-b57976c9-0469-4f22-9b68-d6413608cc1c.json (the URL itself stored as base64 strings), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).