The alipclutch-baileys package includes obfuscated code in lib/Socket/messages-send.js that reconstructs a hardcoded URL (https://fiora.nixel.my.id/) from a decimal-byte array using String.fromCharCode. This URL is unrelated to WhatsApp infrastructure and is contacted during normal message sending operations, diverting message data to a third-party endpoint controlled by the package author. The obfuscation and placement within the core send path strongly indicate covert exfiltration or relay of message traffic leveraging the authenticated session of the user.

Message data sent via the alipclutch-baileys package is diverted to an unauthorized third-party server, potentially exposing sensitive communication content to the package author or other malicious actors. This compromises confidentiality and integrity of message traffic processed through the affected versions of the package.

No official patch or remediation is currently documented for this issue. Users should immediately discontinue use of the affected alipclutch-baileys package versions and replace them with a trusted, verified version of the Baileys library or an alternative. Review and audit any systems or environments where this package was installed for potential data exposure. Monitor for suspicious network traffic to the indicated third-party host and block it if possible. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.