MAL-2026-13402
Malicious code in jagproject (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0d8c56a51a256d7e55c64c71b51b0559ca53c6624e2b225264b13a5061105947) The package (a Baileys-family WhatsApp library fork) contains char-code-obfuscated destination strings in lib/Socket/messages-send.js at lines 425 and 436. The byte arrays passed to String.fromCharCode decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host reconstructed at runtime rather than appearing as a plain string literal. The URL is embedded on the message-send code path, meaning normal use of the library's messaging API routes caller-owned session data through an author-controlled endpoint that is deliberately concealed via char-code obfuscation. Obfuscated destinations in a messaging library's send path have no legitimate purpose and match the covert-relay pattern seen in compromised Baileys forks.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for jagproject (npm). Pin to a known-safe version or switch to an alternative.