{"id":"MAL-2026-13482","summary":"Malicious code in diezyclutch-baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b034105b4e65e2ff38eef557d7b480758070d1122aa6338a6873a9ee76f9111a)\ndiezyclutch-baileys is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js the code constructs a network destination from a String.fromCharCode(...) array that decodes to https://fiora.nixel.my.id/ and issues outbound requests to that host from the message-sending path. Reconstructing the destination URL from a decimal char-code array is deliberate obfuscation of the exfil endpoint; the host is not part of Baileys' documented WhatsApp/Signal protocol traffic and is not a caller-configurable option. This is the canonical shape of a covertly injected exfiltration channel in a WhatsApp-session library, whose messages-send path handles session-authenticated data.\n","modified":"2026-08-07T01:19:48.796159381Z","published":"2026-08-06T23:56:42Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["8.6.78"],"id":"IN-MAL-2026-016852","import_time":"2026-08-07T00:59:21.90696781Z","modified_time":"2026-08-06T23:56:42Z","sha256":"b034105b4e65e2ff38eef557d7b480758070d1122aa6338a6873a9ee76f9111a"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/diezyclutch-baileys/v/8.6.78"}],"affected":[{"package":{"name":"diezyclutch-baileys","ecosystem":"npm","purl":"pkg:npm/diezyclutch-baileys"},"versions":["8.6.78"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"ee63926508fb192a4623b0b57e6bb401b134d0077148ec69ff8c86e85f8a464e6f7bdd","path":"lib/Socket/messages-send.js","sha256":"a62ea8d3d1172824095369efa66412a189a70812354a8d5790b4e9d50004a376"}],"package_integrity":[{"hashes":{"sha1":"fbe952c08199c442e77e89cc5c8cad47b537773e","sha512_sri":"sha512-fUi0sPif0hctw4t8HUqm9uCrWxNPQ5vRpsfQuS0SZmDIaP8k3OQ6zZji9Iha8zEasLuBWlC+nGDlzLyyF63gKA=="},"filename":"diezyclutch-baileys-8.6.78.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/diezyclutch-baileys/MAL-2026-13482.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}