@sahril2nd/baileys

{"modified":"2026-09-09T22:26:53Z","published":"2026-09-09T22:26:53Z","schema_version":"1.7.4","id":"MAL-2026-16105","summary":"Malicious code in @sahril2nd/baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a3d2089d9678322dc8adbf5e6e740c29d6720133df3489970652a2100641435e)\nThis package is a fork of the Baileys WhatsApp library that embeds a hardcoded network destination hidden as a String.fromCharCode(...) decimal-ASCII array inside lib/Socket/messages-send.js. The decoded bytes at lines 425 and 436 reconstruct the URL https://fiora.nixel.my.id/ — a host unrelated to any documented Baileys/WhatsApp infrastructure. The destination is assembled at call-time from a numeric array rather than appearing as a plain-text literal, which is a deliberate concealment technique on the message-send code path where WhatsApp session data and outbound message content are handled. Obfuscated construction of a non-first-party destination inside the messaging pipeline of a WhatsApp client library is the shape of session/message exfiltration to an author-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"@sahril2nd/baileys"},"versions":["1.0.21"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/Socket/messages-send.js","sha256":"a62ea8d3d1172824095369efa66412a189a70812354a8d5790b4e9d50004a376","tlsh":"ee63926508fb192a4623b0b57e6bb401b134d0077148ec69ff8c86e85f8a464e6f7bdd"}],"package_integrity":[{"filename":"baileys-1.0.21.tgz","hashes":{"sha1":"a1fc95215b7811b9f7759e5ac9640a207a1b6ccc","sha512_sri":"sha512-jiVBNjE+nH9S34X+wGdHQXUsRu3DET7O4tdNx+VCQyO8BJa4JUcztX9YvZn5pFCyJsc+xFh7hPjf9TjDLm936Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sahril2nd/baileys/v/1.0.21"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019902","import_time":"2026-09-09T22:38:09.511703034Z","modified_time":"2026-09-09T22:26:53Z","sha256":"a3d2089d9678322dc8adbf5e6e740c29d6720133df3489970652a2100641435e","source":"amazon-inspector","versions":["1.0.21"]}]}}