alipclutch-baileys

{"schema_version":"1.7.4","id":"MAL-2026-12108","published":"2026-08-05T06:16:49Z","modified":"2026-08-06T23:29:17.988044738Z","summary":"Malicious code in alipclutch-baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed)\nThis package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode(...) with a decimal-byte array that decodes to the hardcoded host https://fiora.nixel.my.id/ and issues network requests to it from within the message-send path. The destination is obfuscated (reconstructed from a char-code array rather than appearing as a plain URL literal) and is unrelated to WhatsApp's own infrastructure, so on normal use of the send API caller-side message data is diverted to a third-party endpoint controlled by the package author. The obfuscation of the destination, its placement inside the core send path of a WhatsApp automation library, and the lack of any documented purpose for that host are consistent with covert exfiltration/relay of message traffic using the installer's authenticated session.\n","affected":[{"package":{"name":"alipclutch-baileys","ecosystem":"npm"},"versions":["8.6.60","8.6.58","8.6.59","8.6.75","8.6.77","8.6.63","8.6.70","8.6.71","8.6.64","8.6.66","8.6.72","8.6.61","8.6.74","8.6.65"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/Socket/messages-send.js","sha256":"a438e99ffd668d461a3bcd9fa12394f31d6eb7b4b1bdbed11ffd7be95385799c","tlsh":"ec63926608fb192a4653b0b57e6bb401b134d0037148ec69ff8c86e85f8a464e6f7bdd"}],"package_integrity":[{"filename":"alipclutch-baileys-8.6.60.tgz","hashes":{"sha1":"c3bb5ed6a9da7fa0f09820979efc63fd927d9705","sha512_sri":"sha512-GAuQeIPQaNCfeV08hNRnVK+7PIyUxYVB1BpW3bxFMkbES7Hi5Vjf15FJnj4LXAw6MZzefdfLpbxpBc9J/EOoPA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.60"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.58"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.59"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.75"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.77"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.63"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.70"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.71"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.64"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.66"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.72"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.61"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.74"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/alipclutch-baileys/v/8.6.65"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013395","import_time":"2026-08-05T07:06:45.324982054Z","modified_time":"2026-08-05T06:16:57Z","sha256":"914ba849f03423b886d4f12105a01e1a287678d7f0b0fcde56a994cb1d98270b","source":"amazon-inspector","versions":["8.6.60"]},{"id":"IN-MAL-2026-013396","import_time":"2026-08-05T07:06:45.374794007Z","modified_time":"2026-08-05T06:17:05Z","sha256":"9e396f9a1ec7da97db3c7555aa9c585a4e1b97ea9e50f664be90ffb630ba54af","source":"amazon-inspector","versions":["8.6.58"]},{"id":"IN-MAL-2026-013394","import_time":"2026-08-05T07:06:45.291686756Z","modified_time":"2026-08-05T06:16:49Z","sha256":"ca03288df9bbb08b67462ac23b3727d40e260d84289b5e4db6492f168557d216","source":"amazon-inspector","versions":["8.6.59"]},{"id":"IN-MAL-2026-015899","import_time":"2026-08-05T21:31:21.845436362Z","modified_time":"2026-08-05T21:23:37Z","sha256":"81b0a0abb82a50d7f1228c5094619ccaca0223ca767731d2a91f926f04682c1f","source":"amazon-inspector","versions":["8.6.75"]},{"id":"IN-MAL-2026-015898","import_time":"2026-08-05T21:31:21.736663449Z","modified_time":"2026-08-05T21:23:25Z","sha256":"90942747dea232d93f9a4cf343f8114da75b1d734850542be62db86638f84d85","source":"amazon-inspector","versions":["8.6.77"]},{"id":"IN-MAL-2026-016698","import_time":"2026-08-06T18:09:07.901038062Z","modified_time":"2026-08-06T16:26:40Z","sha256":"441bc34aee09a22b9971936a132f1bab54374a81c21c64311f7603e69595d10e","source":"amazon-inspector","versions":["8.6.63"]},{"id":"IN-MAL-2026-016696","import_time":"2026-08-06T18:09:07.617915184Z","modified_time":"2026-08-06T16:26:24Z","sha256":"48525c68b3e5526524c971e007eb61dd5e2df2637c4a5956c42260ad51c63640","source":"amazon-inspector","versions":["8.6.70"]},{"id":"IN-MAL-2026-016702","import_time":"2026-08-06T18:09:08.397893579Z","modified_time":"2026-08-06T16:27:12Z","sha256":"79cf694c48c1a0928aaf9a5d4fd45eccd0ece5245de408fbae9d22ef58f3e484","source":"amazon-inspector","versions":["8.6.71"]},{"id":"IN-MAL-2026-016704","import_time":"2026-08-06T18:09:08.643591898Z","modified_time":"2026-08-06T16:27:31Z","sha256":"9432f101413761f0feeaa0bc68471a215a8dcea07e84e401c174df37b9469717","source":"amazon-inspector","versions":["8.6.64"]},{"id":"IN-MAL-2026-016697","import_time":"2026-08-06T18:09:07.788354243Z","modified_time":"2026-08-06T16:26:33Z","sha256":"1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed","source":"amazon-inspector","versions":["8.6.66"]},{"id":"IN-MAL-2026-016700","import_time":"2026-08-06T18:09:08.109882862Z","modified_time":"2026-08-06T16:26:55Z","sha256":"6a303dcc495e663fb25970cfd20bf7858f7dea1d16654212247663673c56b6a3","source":"amazon-inspector","versions":["8.6.72"]},{"id":"IN-MAL-2026-016701","import_time":"2026-08-06T18:09:08.238344852Z","modified_time":"2026-08-06T16:27:05Z","sha256":"96052a63685db815a634b3485f0ae0a2622af5e95a8dd81df143fd51eb1b14bc","source":"amazon-inspector","versions":["8.6.61"]},{"id":"IN-MAL-2026-016699","import_time":"2026-08-06T18:09:07.9973242Z","modified_time":"2026-08-06T16:26:47Z","sha256":"9756d5b085f3c63c738d82a6defa97d4067ec9486f155d4bfe203002a09dbb44","source":"amazon-inspector","versions":["8.6.74"]},{"id":"IN-MAL-2026-016703","import_time":"2026-08-06T18:09:08.517085599Z","modified_time":"2026-08-06T16:27:22Z","sha256":"f25a49e29df86f17a2d26aef308f61b0a2e19ba687bc64637c3875e46f5e3173","source":"amazon-inspector","versions":["8.6.65"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}