Malicious code in diezyclutch-baileys (npm)
Malicious code was injected into the diezyclutch-baileys npm package, a fork of the Baileys WhatsApp library. The malicious code in lib/Socket/messages-send.js constructs an obfuscated exfiltration endpoint (https://fiora.nixel.my.id/) and sends session-authenticated data to an attacker-controlled host.
- Disclosed
- Last updated
- Blast radius
- Any application using diezyclutch-baileys for WhatsApp/Signal messaging would have session-authenticated data exfiltrated to the attacker-controlled endpoint.
- Ecosystems
- Attack vectors
- Affected entities
- diezyclutch-baileysFork of Baileys WhatsApp library containing malicious exfiltration code
diezyclutch-baileys is a fork of the Baileys WhatsApp library published on npm. Security analysis identified malicious code deliberately injected into the package's message-sending functionality.
The malicious payload is located in lib/Socket/messages-send.js and uses String.fromCharCode() to construct an obfuscated network destination URL (https://fiora.nixel.my.id/). This endpoint is not part of the documented WhatsApp or Signal protocol traffic and is not a configurable option in the legitimate Baileys library.
The exfiltration channel is positioned in the message-sending path, which handles session-authenticated data. This allows the attacker to intercept and exfiltrate sensitive WhatsApp session information from any application using this compromised package.
The obfuscation technique (decimal char-code array decoding) is a deliberate attempt to hide the malicious behavior from code review and automated scanning tools.
Indicators of compromise
- Packages
- diezyclutch-baileys
- Domains
- fiora.nixel.my.id
Remediation
- Remove diezyclutch-baileys from all dependencies immediately
- Audit any systems that installed this package for unauthorized network connections to fiora.nixel.my.id
- Rotate WhatsApp session credentials and authentication tokens on affected systems
- Use the legitimate Baileys library (github.com/WhiskeySockets/Baileys) instead
- Review npm package dependencies for other suspicious forks or typosquatting variants
- Monitor for any data exfiltration to the identified endpoint
Sources
- GitHub Advisory GHSA-xqrx-4hpr-8cx7 · GitHub Advisory Database
Cite this entry
"Malicious code in diezyclutch-baileys (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-diezyclutch-baileys-npm-c3z1ne
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in nodeberlin (npm)
The npm package nodeberlin contained malicious code that captured clipboard contents and screenshots, exfiltrating them to a hardcoded attacker-controlled endpoint. The package auto-downloaded Python dependencies and established global hotkeys for screen capture and data relay.
npmMalicious commit