OpenSSF/OSV advisory MAL-2026-12108 confirms this npm version as malicious. This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode(...) with a decimal-byte array that decodes to the hardcoded host https://fiora.nixel.my.id/ and issues network requests to it from within the message-send path...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in alipclutch-baileys (npm)
Details
This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode(...) with a decimal-byte array that decodes to the hardcoded host https://fiora.nixel.my.id/ and issues network requests to it from within the message-send path. The destination is obfuscated (reconstructed from a char-code array rather than appearing as a plain URL literal) and is unrelated to WhatsApp's own infrastructure, so on normal use of the send API caller-side message data is diverted to a third-party endpoint controlled by the package author. The obfuscation of the destination, its placement inside the core send path of a WhatsApp automation library, and the lack of any documented purpose for that host are consistent with covert exfiltration/relay of message traffic using the installer's authenticated session.
Decision reason
OpenSSF Malicious Packages via OSV confirms alipclutch-baileys@8.6.66 as malicious (MAL-2026-12108): Malicious code in alipclutch-baileys (npm)