MalwarePublished 6 Aug 2026Updated 8 Aug 2026

jagproject (npm) · Malicious Code

Affects jagprojectSource GCVE Database

Malicious package : remove jagproject and rotate any secrets on hosts that installed it.

Data as of 8 Aug 2026, 14:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13402

What to do

Remove jagproject from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmjagproject	Affected =28.1.0 =28.3.0 =28.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced) lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline.

Impact

The malicious code causes session data from users of the jagproject library to be sent to an unauthorized third-party server controlled by the attacker. This compromises the confidentiality of the session data and potentially exposes sensitive user information. The obfuscation of the URL makes detection and analysis more difficult, increasing the risk of unnoticed data exfiltration.

Defensive guidance

Users should avoid using the affected versions (=28.1.0, =28.2.0, =28.3.0) of the jagproject package. It is recommended to audit dependencies for this package and replace it with a trusted, verified version or alternative library. Monitor vendor advisories for any forthcoming official fixes or updates.

Summary

The jagproject package versions 28.1.0, 28.2.0, and 28.3.0 include char-code-obfuscated destination strings in the file lib/Socket/messages-send.js. These strings decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host that is reconstructed at runtime rather than appearing as a plain string literal. This URL is embedded in the message sending code path, causing caller-owned session data to be routed through an author-controlled endpoint covertly. This pattern aligns with known covert-relay techniques used in compromised forks of the Baileys WhatsApp library, indicating malicious intent.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:39 UTC

Technical details

References

Community reviews