Malicious code in ynastore-baileys (npm)
The ynastore-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that obfuscates a network destination URL to exfiltrate message-related data. The code reconstructs a URL to a non-associated domain (fiora.nixel.my.id) using decimal char codes to evade source inspection. This malicious endpoint receives data during normal message sending operations, potentially leaking sensitive user information. The issue affects version 1.0.21 of ynastore-baileys. There is no CVSS score or known exploit in the wild reported for this threat.
AI Analysis
Technical Summary
The ynastore-baileys package (version 1.0.21) includes obfuscated code in lib/Socket/messages-send.js that reconstructs a URL via decimal char codes pointing to https://fiora.nixel.my.id/, a domain unrelated to the legitimate Baileys or WhatsApp projects. This pattern is indicative of exfiltration or silent relay of data. Since the malicious code is invoked during the normal message sending flow, message data from users of this fork is routed to an attacker-controlled server, constituting a supply chain compromise through a malicious npm package.
Potential Impact
Message-related data from users of the affected ynastore-baileys version is silently sent to an attacker-controlled external domain, leading to potential data leakage and privacy violations. This compromises the confidentiality of communications handled by the library.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should avoid using the affected version (=1.0.21) of ynastore-baileys and instead use the original Baileys library or verified clean forks. Monitor vendor advisories for any updates or fixes. Since this is a malicious package, removing it from the dependency tree is recommended.
Malicious code in ynastore-baileys (npm)
Description
The ynastore-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that obfuscates a network destination URL to exfiltrate message-related data. The code reconstructs a URL to a non-associated domain (fiora.nixel.my.id) using decimal char codes to evade source inspection. This malicious endpoint receives data during normal message sending operations, potentially leaking sensitive user information. The issue affects version 1.0.21 of ynastore-baileys. There is no CVSS score or known exploit in the wild reported for this threat.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ynastore-baileys package (version 1.0.21) includes obfuscated code in lib/Socket/messages-send.js that reconstructs a URL via decimal char codes pointing to https://fiora.nixel.my.id/, a domain unrelated to the legitimate Baileys or WhatsApp projects. This pattern is indicative of exfiltration or silent relay of data. Since the malicious code is invoked during the normal message sending flow, message data from users of this fork is routed to an attacker-controlled server, constituting a supply chain compromise through a malicious npm package.
Potential Impact
Message-related data from users of the affected ynastore-baileys version is silently sent to an attacker-controlled external domain, leading to potential data leakage and privacy violations. This compromises the confidentiality of communications handled by the library.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should avoid using the affected version (=1.0.21) of ynastore-baileys and instead use the original Baileys library or verified clean forks. Monitor vendor advisories for any updates or fixes. Since this is a malicious package, removing it from the dependency tree is recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13470
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a75744cbf8831d539d9afbd
Added to database: 08/07/2026, 05:59:40 UTC
Last enriched: 08/07/2026, 06:12:44 UTC
Last updated: 08/08/2026, 01:22:09 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.