The santana-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly sends message data to an attacker-controlled external host. The package reconstructs a hidden URL via character-code obfuscation and directs WhatsApp session messages to this unauthorized third-party endpoint. Installation or use of this package compromises the host system, potentially exposing all stored secrets and keys.