diezyclutch-baileys

{"modified":"2026-08-06T23:56:42Z","published":"2026-08-06T23:56:42Z","schema_version":"1.7.4","id":"MAL-2026-13482","summary":"Malicious code in diezyclutch-baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b034105b4e65e2ff38eef557d7b480758070d1122aa6338a6873a9ee76f9111a)\ndiezyclutch-baileys is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js the code constructs a network destination from a String.fromCharCode(...) array that decodes to https://fiora.nixel.my.id/ and issues outbound requests to that host from the message-sending path. Reconstructing the destination URL from a decimal char-code array is deliberate obfuscation of the exfil endpoint; the host is not part of Baileys' documented WhatsApp/Signal protocol traffic and is not a caller-configurable option. This is the canonical shape of a covertly injected exfiltration channel in a WhatsApp-session library, whose messages-send path handles session-authenticated data.\n","affected":[{"package":{"ecosystem":"npm","name":"diezyclutch-baileys"},"versions":["8.6.78"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/Socket/messages-send.js","sha256":"a62ea8d3d1172824095369efa66412a189a70812354a8d5790b4e9d50004a376","tlsh":"ee63926508fb192a4623b0b57e6bb401b134d0077148ec69ff8c86e85f8a464e6f7bdd"}],"package_integrity":[{"filename":"diezyclutch-baileys-8.6.78.tgz","hashes":{"sha1":"fbe952c08199c442e77e89cc5c8cad47b537773e","sha512_sri":"sha512-fUi0sPif0hctw4t8HUqm9uCrWxNPQ5vRpsfQuS0SZmDIaP8k3OQ6zZji9Iha8zEasLuBWlC+nGDlzLyyF63gKA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/diezyclutch-baileys/v/8.6.78"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016852","import_time":"2026-08-07T00:59:21.90696781Z","modified_time":"2026-08-06T23:56:42Z","sha256":"b034105b4e65e2ff38eef557d7b480758070d1122aa6338a6873a9ee76f9111a","source":"amazon-inspector","versions":["8.6.78"]}]}}