The santana-baileys package modifies the message sending functionality by reconstructing a destination URL from an obfuscated decimal char-code array, which resolves to https://fiora.nixel.my.id/. This endpoint is not part of the legitimate WhatsApp infrastructure and is hidden within the message-send code path. As a result, message send operations on the authenticated WhatsApp session are relayed to an attacker-controlled host, enabling covert exfiltration of messaging data. The package is considered fully malicious, and any system running it should be treated as compromised.

Systems with the santana-baileys package installed or running are fully compromised. The attacker may gain access to all secrets and keys stored on the system. The malicious code enables covert relay of WhatsApp session messages to an unauthorized external host, risking data exfiltration and loss of confidentiality.

Remove the santana-baileys package immediately. Rotate all secrets and keys from a separate, uncompromised system. Due to the full compromise risk, additional system integrity checks and remediation may be necessary. No official patch is available; the package itself is malicious and should not be used.