MAL-2026-13456
Malicious code in santana-baileys (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a01fc218f60217e160355fc41c6006c25da2197ea1fec2b3402df38e125e4252) santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) reconstructs a destination URL from a decimal char-code array via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47,...), which decodes to https://fiora.nixel.my.id/. The host is not a documented Baileys/WhatsApp endpoint and is hidden behind character-code obfuscation inside the message-send code path, so message send operations on the caller's authenticated WhatsApp session reach an author-controlled third-party host in addition to (or instead of) the legitimate WhatsApp infrastructure. Obfuscated reconstruction of a non-first-party destination inside a session-privileged send path is the shape of covert relay/exfiltration of caller messaging data through an author endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for santana-baileys (npm). Pin to a known-safe version or switch to an alternative.