MAL-2026-13470

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ynastore-baileys/MAL-2026-13470.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13470
Published
2026-08-06T19:22:03Z
Modified
2026-08-06T23:50:30.082277445Z
Summary
Malicious code in ynastore-baileys (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5636385d60c311b2159f6aed3cf5d9d66abb6cb5af562d432920c63944759f30)

ynastore-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 and 436 reconstruct a network destination via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47...), which decodes to https://fiora.nixel.my.id/. Encoding a network host as a decimal char-code array to hide it from source-tree inspection is the exfiltration/silent-relay obfuscation pattern; a legitimate first-party endpoint in a WhatsApp library would appear as a plain URL literal. The host fiora.nixel.my.id is not a Baileys/WhatsApp-associated domain, and the messages-send code path is invoked as part of the library's normal send flow, so message-related data belonging to consumers of this fork is routed to an author-controlled destination during ordinary use.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016765",
            "import_time": "2026-08-06T23:25:08.172578721Z",
            "sha256": "5636385d60c311b2159f6aed3cf5d9d66abb6cb5af562d432920c63944759f30",
            "versions": [
                "1.0.21"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:22:03Z"
        }
    ]
}
References
Credits

Affected packages

npm / ynastore-baileys

Package

Name
ynastore-baileys
View open source insights on deps.dev
Purl
pkg:npm/ynastore-baileys

Affected ranges

Affected versions

1.*
1.0.21

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/Socket/messages-send.js",
            "tlsh": "ee63926508fb192a4623b0b57e6bb401b134d0077148ec69ff8c86e85f8a464e6f7bdd",
            "sha256": "a62ea8d3d1172824095369efa66412a189a70812354a8d5790b4e9d50004a376"
        }
    ],
    "package_integrity": [
        {
            "filename": "ynastore-baileys-1.0.21.tgz",
            "hashes": {
                "sha512_sri": "sha512-rtxeustGU3Q5jIxyOpAsWtxXuXE54E1xEhIhl61SfHkDvhPKuvHMd12WYp8oicfNEIBR0n153m4KWT/1NJMCUA==",
                "sha1": "fde5676fb03e9321c773253ea9a22078b07ad27d"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ynastore-baileys/MAL-2026-13470.json"