MalwarePublished 6 Aug 2026Updated 25 Aug 2026

santana-baileys (npm) · Malicious Code

Affects santana-baileysSource GCVE Database

Malicious package : remove santana-baileys and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 06:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13456

What to do

Remove santana-baileys from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsantana-baileys	Affected =2.0.4 =2.0.2 =2.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The santana-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly sends message data to an attacker-controlled external host. The package reconstructs a hidden URL via character-code obfuscation and directs WhatsApp session messages to this unauthorized third-party endpoint. Installation or use of this package compromises the host system, potentially exposing all stored secrets and keys.

Impact

Systems with the santana-baileys package installed or running are fully compromised. The attacker may gain access to all secrets and keys stored on the system. The malicious code enables covert relay of WhatsApp session messages to an unauthorized external host, risking data exfiltration and loss of confidentiality.

Defensive guidance

Remove the santana-baileys package immediately. Rotate all secrets and keys from a separate, uncompromised system. Due to the full compromise risk, additional system integrity checks and remediation may be necessary.

Summary

The santana-baileys package modifies the message sending functionality by reconstructing a destination URL from an obfuscated decimal char-code array, which resolves to https://fiora.nixel.my.id/. This endpoint is not part of the legitimate WhatsApp infrastructure and is hidden within the message-send code path. As a result, message send operations on the authenticated WhatsApp session are relayed to an attacker-controlled host, enabling covert exfiltration of messaging data. The package is considered fully malicious, and any system running it should be treated as compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 06:46 UTC

Technical details

References

Community reviews