The jagproject package versions 28.1.0, 28.2.0, and 28.3.0 include char-code-obfuscated destination strings in the file lib/Socket/messages-send.js. These strings decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host that is reconstructed at runtime rather than appearing as a plain string literal. This URL is embedded in the message sending code path, causing caller-owned session data to be routed through an author-controlled endpoint covertly. This pattern aligns with known covert-relay techniques used in compromised forks of the Baileys WhatsApp library, indicating malicious intent.

The malicious code causes session data from users of the jagproject library to be sent to an unauthorized third-party server controlled by the attacker. This compromises the confidentiality of the session data and potentially exposes sensitive user information. The obfuscation of the URL makes detection and analysis more difficult, increasing the risk of unnoticed data exfiltration.

No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions (=28.1.0, =28.2.0, =28.3.0) of the jagproject package. It is recommended to audit dependencies for this package and replace it with a trusted, verified version or alternative library. Monitor vendor advisories for any forthcoming official fixes or updates.