Malicious code in jagproject (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced) lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline.
AI Analysis
Technical Summary
The jagproject package versions 28.1.0, 28.2.0, and 28.3.0 include char-code-obfuscated destination strings in the file lib/Socket/messages-send.js. These strings decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host that is reconstructed at runtime rather than appearing as a plain string literal. This URL is embedded in the message sending code path, causing caller-owned session data to be routed through an author-controlled endpoint covertly. This pattern aligns with known covert-relay techniques used in compromised forks of the Baileys WhatsApp library, indicating malicious intent.
Potential Impact
The malicious code causes session data from users of the jagproject library to be sent to an unauthorized third-party server controlled by the attacker. This compromises the confidentiality of the session data and potentially exposes sensitive user information. The obfuscation of the URL makes detection and analysis more difficult, increasing the risk of unnoticed data exfiltration.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions (=28.1.0, =28.2.0, =28.3.0) of the jagproject package. It is recommended to audit dependencies for this package and replace it with a trusted, verified version or alternative library. Monitor vendor advisories for any forthcoming official fixes or updates.
Malicious code in jagproject (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced) lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The jagproject package versions 28.1.0, 28.2.0, and 28.3.0 include char-code-obfuscated destination strings in the file lib/Socket/messages-send.js. These strings decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host that is reconstructed at runtime rather than appearing as a plain string literal. This URL is embedded in the message sending code path, causing caller-owned session data to be routed through an author-controlled endpoint covertly. This pattern aligns with known covert-relay techniques used in compromised forks of the Baileys WhatsApp library, indicating malicious intent.
Potential Impact
The malicious code causes session data from users of the jagproject library to be sent to an unauthorized third-party server controlled by the attacker. This compromises the confidentiality of the session data and potentially exposes sensitive user information. The obfuscation of the URL makes detection and analysis more difficult, increasing the risk of unnoticed data exfiltration.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions (=28.1.0, =28.2.0, =28.3.0) of the jagproject package. It is recommended to audit dependencies for this package and replace it with a trusted, verified version or alternative library. Monitor vendor advisories for any forthcoming official fixes or updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13402
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a74cf8ebf8831d5391aea3a
Added to database: 08/06/2026, 18:16:46 UTC
Last enriched: 08/06/2026, 18:39:42 UTC
Last updated: 09/18/2026, 02:12:42 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.