OpenSSF/OSV advisory MAL-2026-12108 confirms this npm version as malicious. The package (a fork/lookalike of the Baileys WhatsApp library) contains a hidden network destination in lib/Socket/messages-send.js. At lines 425 and 436, the destination URL is reconstructed at runtime from a String.fromCharCode(...) numeric array that decodes to https://fiora.nixel.my.id/...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in alipclutch-baileys (npm)
Details
The package (a fork/lookalike of the Baileys WhatsApp library) contains a hidden network destination in lib/Socket/messages-send.js. At lines 425 and 436, the destination URL is reconstructed at runtime from a String.fromCharCode(...) numeric array that decodes to https://fiora.nixel.my.id/. Encoding a destination host as a char-code array within the message-send path is an obfuscation technique used to conceal the endpoint from casual source inspection; the decoded host is not part of the WhatsApp/Baileys protocol surface and is not a documented, caller-configured endpoint. Given that this file is on the outgoing-message path of a WhatsApp client library, the injected destination is positioned to receive message-related data (session identifiers, message contents, or authentication material) from the installer's session at runtime.
Decision reason
OpenSSF Malicious Packages via OSV confirms alipclutch-baileys@8.6.59 as malicious (MAL-2026-12108): Malicious code in alipclutch-baileys (npm)