The diezyclutch-baileys npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly exfiltrates data. The exfiltration is performed by constructing a network destination URL via obfuscated character codes that decode to an unauthorized external host (https://fiora.nixel.my.id/). This host is not part of the legitimate WhatsApp or Signal protocol traffic and is hardcoded, not configurable by users. The malicious code resides in the message-sending path, which handles session-authenticated data, enabling potential unauthorized data leakage.