MAL-2026-13443

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/diezyyasha-baileys/MAL-2026-13443.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13443
Aliases
  • GHSA-78fc-2672-hcjg
Published
2026-08-06T14:23:02Z
Modified
2026-08-07T12:35:10.559434650Z
Summary
Malicious code in diezyyasha-baileys (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745)

diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines 425 and 436 the code constructs a URL via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47) which decodes to https://fiora.nixel.my.id/ — a hardcoded third-party host reconstructed from a char-code array rather than a plain string. This destination is embedded inside the message-sending code path of a WhatsApp session library, where the caller has already provided authenticated session credentials and where message content, contacts, and session identifiers are handled. The obfuscated-destination pattern (char-code reconstruction) inside a wallet/messaging-session code path is the exfiltration fingerprint: a first-party integration would use a plain, configurable URL, not a fromCharCode-reconstructed hardcoded host in a fork of an upstream library.

Source: ghsa-malware (d60ca6b8b819cd26dec799a772e0dfcac120666bffee2f4d686291b2d4e5a3dc)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "9.0.0"
            ],
            "id": "IN-MAL-2026-016694",
            "import_time": "2026-08-06T18:09:07.293165797Z",
            "modified_time": "2026-08-06T16:25:08Z",
            "source": "amazon-inspector",
            "sha256": "037d49e30bd4a4e1ac1d9ef3c3225dfc615a7f7a6c8cb389b54472fb71202187"
        },
        {
            "versions": [
                "8.6.59"
            ],
            "id": "IN-MAL-2026-016691",
            "import_time": "2026-08-06T18:09:06.803995135Z",
            "modified_time": "2026-08-06T16:24:43Z",
            "source": "amazon-inspector",
            "sha256": "bbe3726b4eb4207c25d19364cc7db0443dfe0c039ed6b7fed5b6e67685c79a88"
        },
        {
            "modified_time": "2026-08-06T16:24:28Z",
            "id": "IN-MAL-2026-016689",
            "import_time": "2026-08-06T18:09:06.5924292Z",
            "versions": [
                "8.6.58"
            ],
            "source": "amazon-inspector",
            "sha256": "05eb9855a0d2c89a3e18b2adf8223b53f0113f08475118745b9c590268e5b54e"
        },
        {
            "versions": [
                "8.6.62"
            ],
            "id": "IN-MAL-2026-016693",
            "import_time": "2026-08-06T18:09:07.172479282Z",
            "modified_time": "2026-08-06T16:24:58Z",
            "source": "amazon-inspector",
            "sha256": "1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745"
        },
        {
            "versions": [
                "9.1.3"
            ],
            "id": "IN-MAL-2026-016688",
            "import_time": "2026-08-06T18:09:06.456289945Z",
            "modified_time": "2026-08-06T16:24:12Z",
            "source": "amazon-inspector",
            "sha256": "551277cb1e4427399fa06a2939a5a66e4263a0e90a2a1eb442f9307eddbec2ec"
        },
        {
            "modified_time": "2026-08-06T16:24:36Z",
            "id": "IN-MAL-2026-016690",
            "import_time": "2026-08-06T18:09:06.70298153Z",
            "versions": [
                "8.6.61"
            ],
            "source": "amazon-inspector",
            "sha256": "5cbdd04a0192bda65f7e8104db2f7fdc5d969f8d19e7e100f7e841a04cb50fba"
        },
        {
            "versions": [
                "9.1.5"
            ],
            "id": "IN-MAL-2026-016687",
            "import_time": "2026-08-06T18:09:06.330159482Z",
            "modified_time": "2026-08-06T16:23:57Z",
            "source": "amazon-inspector",
            "sha256": "606003796f496e0bba9381dfc5841975e7f6f34bc41c5c85f90d0f2be2708656"
        },
        {
            "versions": [
                "9.2.0"
            ],
            "id": "IN-MAL-2026-016686",
            "import_time": "2026-08-06T18:09:06.144663777Z",
            "modified_time": "2026-08-06T16:23:44Z",
            "source": "amazon-inspector",
            "sha256": "84150eef2683d9db256ffe5512be591c24ae3623d5e78480591c59ba7567ed32"
        },
        {
            "modified_time": "2026-08-06T16:24:51Z",
            "id": "IN-MAL-2026-016692",
            "import_time": "2026-08-06T18:09:06.918472395Z",
            "versions": [
                "8.6.57"
            ],
            "source": "amazon-inspector",
            "sha256": "9fe8f4e095ae1cbda478bfed106b46a45fd26ddd68053a6733698c5dc72b489a"
        },
        {
            "modified_time": "2026-08-06T14:23:03Z",
            "id": "GHSA-78fc-2672-hcjg",
            "import_time": "2026-08-06T23:53:00.671561383Z",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "ghsa-malware",
            "sha256": "d60ca6b8b819cd26dec799a772e0dfcac120666bffee2f4d686291b2d4e5a3dc"
        },
        {
            "versions": [
                "8.6.60"
            ],
            "id": "IN-MAL-2026-016923",
            "import_time": "2026-08-07T12:23:27.289695023Z",
            "modified_time": "2026-08-07T12:18:10Z",
            "source": "amazon-inspector",
            "sha256": "fb14b4bbab00ab0c80a269a7f160cf54e9bdd77c8656fb646b25f2bb4f7ba253"
        },
        {
            "versions": [
                "9.1.1"
            ],
            "id": "IN-MAL-2026-016928",
            "import_time": "2026-08-07T12:23:27.45396681Z",
            "modified_time": "2026-08-07T12:18:53Z",
            "source": "amazon-inspector",
            "sha256": "5c9217db259389ae5aabf22691d6ec15fc84343c2aa2aa52ae459f4e7721ef96"
        },
        {
            "versions": [
                "9.1.0"
            ],
            "id": "IN-MAL-2026-016917",
            "import_time": "2026-08-07T12:23:27.083153225Z",
            "modified_time": "2026-08-07T12:17:22Z",
            "source": "amazon-inspector",
            "sha256": "93752f5adacd02b9b2bde00e6eb5053e6d6cbfc467a8fc27de064e32d08b6315"
        },
        {
            "modified_time": "2026-08-07T12:18:45Z",
            "id": "IN-MAL-2026-016927",
            "import_time": "2026-08-07T12:23:27.424256285Z",
            "versions": [
                "9.1.2"
            ],
            "source": "amazon-inspector",
            "sha256": "f2efd2c560a95f474d498c45ca71fd675eb01bd83912da072ca185f6d240bb86"
        }
    ]
}
References
Credits

Affected packages

npm / diezyyasha-baileys

Package

Name
diezyyasha-baileys
View open source insights on deps.dev
Purl
pkg:npm/diezyyasha-baileys

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

8.*
8.6.57
8.6.58
8.6.59
8.6.60
8.6.61
8.6.62
9.*
9.0.0
9.1.0
9.1.1
9.1.2
9.1.3
9.1.5
9.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/Socket/messages-send.js",
            "tlsh": "ec63926608fb192a4653b0b57e6bb401b134d0037148ec69ff8c86e85f8a464e6f7bdd",
            "sha256": "a438e99ffd668d461a3bcd9fa12394f31d6eb7b4b1bdbed11ffd7be95385799c"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/diezyyasha-baileys/MAL-2026-13443.json"