Malicious code in diezyclutch-baileys (npm)
The diezyclutch-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly exfiltrates data. The exfiltration is performed by constructing a network destination URL via obfuscated character codes that decode to an unauthorized external host (https://fiora.nixel.my.id/). This host is not part of the legitimate WhatsApp or Signal protocol traffic and is hardcoded, not configurable by users. The malicious code resides in the message-sending path, which handles session-authenticated data, enabling potential unauthorized data leakage.
AI Analysis
Technical Summary
The diezyclutch-baileys package version 8.6.78 includes deliberately obfuscated code in lib/Socket/messages-send.js that constructs a URL from a decimal character code array. This URL points to https://fiora.nixel.my.id/, an external host unrelated to the official WhatsApp or Signal protocols. The package issues outbound requests to this host during message sending, creating a covert exfiltration channel for session-authenticated data. This behavior indicates malicious intent embedded within the package, compromising confidentiality by sending data to an unauthorized third party.
Potential Impact
This malicious code can lead to unauthorized exfiltration of sensitive session data from users of the diezyclutch-baileys package version 8.6.78. Since the exfiltration occurs in the message-sending path, it may leak authenticated session information, potentially compromising user privacy and security. There is no indication of active exploitation in the wild at this time.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package version. Users should immediately discontinue use of diezyclutch-baileys version 8.6.78 and replace it with the official Baileys library or a trusted alternative. Verify package integrity and source before installation to avoid malicious forks. Monitor for vendor advisories or community updates regarding remediation or removal.
Malicious code in diezyclutch-baileys (npm)
Description
The diezyclutch-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly exfiltrates data. The exfiltration is performed by constructing a network destination URL via obfuscated character codes that decode to an unauthorized external host (https://fiora.nixel.my.id/). This host is not part of the legitimate WhatsApp or Signal protocol traffic and is hardcoded, not configurable by users. The malicious code resides in the message-sending path, which handles session-authenticated data, enabling potential unauthorized data leakage.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The diezyclutch-baileys package version 8.6.78 includes deliberately obfuscated code in lib/Socket/messages-send.js that constructs a URL from a decimal character code array. This URL points to https://fiora.nixel.my.id/, an external host unrelated to the official WhatsApp or Signal protocols. The package issues outbound requests to this host during message sending, creating a covert exfiltration channel for session-authenticated data. This behavior indicates malicious intent embedded within the package, compromising confidentiality by sending data to an unauthorized third party.
Potential Impact
This malicious code can lead to unauthorized exfiltration of sensitive session data from users of the diezyclutch-baileys package version 8.6.78. Since the exfiltration occurs in the message-sending path, it may leak authenticated session information, potentially compromising user privacy and security. There is no indication of active exploitation in the wild at this time.
Mitigation Recommendations
No official patch or remediation is currently documented for this malicious package version. Users should immediately discontinue use of diezyclutch-baileys version 8.6.78 and replace it with the official Baileys library or a trusted alternative. Verify package integrity and source before installation to avoid malicious forks. Monitor for vendor advisories or community updates regarding remediation or removal.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13482
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7573b5bf8831d539d93a84
Added to database: 08/07/2026, 05:57:09 UTC
Last enriched: 08/07/2026, 08:02:12 UTC
Last updated: 09/21/2026, 22:45:49 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.