MAL-2026-13456

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/santana-baileys/MAL-2026-13456.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13456
Published
2026-08-06T19:48:57Z
Modified
2026-08-06T23:50:19.681288263Z
Summary
Malicious code in santana-baileys (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a01fc218f60217e160355fc41c6006c25da2197ea1fec2b3402df38e125e4252)

santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) reconstructs a destination URL from a decimal char-code array via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47,...), which decodes to https://fiora.nixel.my.id/. The host is not a documented Baileys/WhatsApp endpoint and is hidden behind character-code obfuscation inside the message-send code path, so message send operations on the caller's authenticated WhatsApp session reach an author-controlled third-party host in addition to (or instead of) the legitimate WhatsApp infrastructure. Obfuscated reconstruction of a non-first-party destination inside a session-privileged send path is the shape of covert relay/exfiltration of caller messaging data through an author endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016820",
            "import_time": "2026-08-06T23:25:11.004204969Z",
            "sha256": "9ef39ee30177084bba789408b36a85c691a43a3ecc7f030e451251cda67d7c1b",
            "versions": [
                "2.0.4"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:48:57Z"
        },
        {
            "id": "IN-MAL-2026-016822",
            "import_time": "2026-08-06T23:25:11.09310665Z",
            "sha256": "a01fc218f60217e160355fc41c6006c25da2197ea1fec2b3402df38e125e4252",
            "versions": [
                "2.0.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:49:12Z"
        },
        {
            "id": "IN-MAL-2026-016821",
            "import_time": "2026-08-06T23:25:11.05884509Z",
            "sha256": "c43fc5c4cbe6cce57fe99e95f29bbcfa12349763128bb25fd29c92281f581f30",
            "versions": [
                "2.0.3"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:49:04Z"
        }
    ]
}
References
Credits

Affected packages

npm / santana-baileys

Package

Name
santana-baileys
View open source insights on deps.dev
Purl
pkg:npm/santana-baileys

Affected ranges

Affected versions

2.*
2.0.2
2.0.3
2.0.4

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/Socket/messages-send.js",
            "tlsh": "ec63926608fb192a4653b0b57e6bb401b134d0037148ec69ff8c86e85f8a464e6f7bdd",
            "sha256": "a438e99ffd668d461a3bcd9fa12394f31d6eb7b4b1bdbed11ffd7be95385799c"
        }
    ],
    "package_integrity": [
        {
            "filename": "santana-baileys-2.0.4.tgz",
            "hashes": {
                "sha1": "c0ed9429f3f10bed5e8b140632c56c655ab1ba1e",
                "sha512_sri": "sha512-aKemQuNrQkSs3nOJK4vY7GmCQfqV/UGR4Zti8LlOFJCvXvg4D+MBMATresPa3e1Jit9fwRwd4761HGV3sB42eg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/santana-baileys/MAL-2026-13456.json"