diezyclutch-baileys

GHSA-xqrx-4hpr-8cx7

Malicious code in diezyclutch-baileys (npm)

Details

**Severity:** Critical

**Affected versions:** `= 8.6.78`

## Source: amazon-inspector (b034105b4e65e2ff38eef557d7b480758070d1122aa6338a6873a9ee76f9111a)
diezyclutch-baileys is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js the code constructs a network destination from a String.fromCharCode(...) array that decodes to https://fiora.nixel.my.id/ and issues outbound requests to that host from the message-sending path. Reconstructing the destination URL from a decimal char-code array is deliberate obfuscation of the exfil endpoint; the host is not part of Baileys' documented WhatsApp/Signal protocol traffic and is not a caller-configurable option. This is the canonical shape of a covertly injected exfiltration channel in a WhatsApp-session library, whose messages-send path handles session-authenticated data.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/f8d6dbca88029f7084e1904bf07393368dc9681e/osv/malicious/npm/diezyclutch-baileys/MAL-2026-13482.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/f8d6dbca88029f7084e1904bf07393368dc9681e/osv/malicious/npm/diezyclutch-baileys/MAL-2026-13482.json
- https://www.npmjs.com/package/diezyclutch-baileys/v/8.6.78
- https://github.com/advisories/GHSA-xqrx-4hpr-8cx7

Compromised versions (1)

= 8.6.78

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.