{"id":"MAL-2026-16105","summary":"Malicious code in @sahril2nd/baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a3d2089d9678322dc8adbf5e6e740c29d6720133df3489970652a2100641435e)\nThis package is a fork of the Baileys WhatsApp library that embeds a hardcoded network destination hidden as a String.fromCharCode(...) decimal-ASCII array inside lib/Socket/messages-send.js. The decoded bytes at lines 425 and 436 reconstruct the URL https://fiora.nixel.my.id/ — a host unrelated to any documented Baileys/WhatsApp infrastructure. The destination is assembled at call-time from a numeric array rather than appearing as a plain-text literal, which is a deliberate concealment technique on the message-send code path where WhatsApp session data and outbound message content are handled. Obfuscated construction of a non-first-party destination inside the messaging pipeline of a WhatsApp client library is the shape of session/message exfiltration to an author-controlled endpoint.\n","modified":"2026-09-09T22:45:44.754734887Z","published":"2026-09-09T22:26:53Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-09T22:26:53Z","sha256":"a3d2089d9678322dc8adbf5e6e740c29d6720133df3489970652a2100641435e","source":"amazon-inspector","versions":["1.0.21"],"id":"IN-MAL-2026-019902","import_time":"2026-09-09T22:38:09.511703034Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sahril2nd/baileys/v/1.0.21"}],"affected":[{"package":{"name":"@sahril2nd/baileys","ecosystem":"npm","purl":"pkg:npm/%40sahril2nd/baileys"},"versions":["1.0.21"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"baileys-1.0.21.tgz","hashes":{"sha1":"a1fc95215b7811b9f7759e5ac9640a207a1b6ccc","sha512_sri":"sha512-jiVBNjE+nH9S34X+wGdHQXUsRu3DET7O4tdNx+VCQyO8BJa4JUcztX9YvZn5pFCyJsc+xFh7hPjf9TjDLm936Q=="}}],"evidence_files":[{"path":"lib/Socket/messages-send.js","sha256":"a62ea8d3d1172824095369efa66412a189a70812354a8d5790b4e9d50004a376","tlsh":"ee63926508fb192a4623b0b57e6bb401b134d0077148ec69ff8c86e85f8a464e6f7bdd"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sahril2nd/baileys/MAL-2026-16105.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}