Loading npm security reports…
WhatsApp API Modification
OpenSSF/OSV advisory MAL-2026-13482 confirms this npm version as malicious. diezyclutch-baileys is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js the code constructs a network destination from a String.fromCharCode(...) array that decodes to https://fiora.nixel.my.id/ and issues outbound requests to that host from the message-sending path...
Package defines install-time lifecycle scripts.
package.jsonView on unpkgSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
lib/index.jsView on unpkg · L22A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/index.jsView on unpkgPackage contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages-media.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L33Package contains source files above the normal full-analysis size ceiling.
WAProto/index.jsView on unpkgSource file is highly similar to a previously finalized malicious package; route for source-aware review.
lib/Utils/messages-media.jsView on unpkgSource contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
lib/index.jsView on unpkg · L22A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
lib/index.jsView on unpkg