Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
- Disclosed
- Last updated
- Blast radius
- All users of affected santana-baileys versions who send WhatsApp messages through the library
- Ecosystems
- Attack vectors
- Affected entities
- santana-baileysnpm package; fork of Baileys WhatsApp library
The npm package santana-baileys, a fork of the Baileys WhatsApp library, contained malicious code that intercepts authenticated WhatsApp session operations. The malicious code is located in lib/Socket/messages-send.js at lines 425 and 436, where it reconstructs a destination URL from a decimal character-code array using String.fromCharCode(), decoding to https://fiora.nixel.my.id/.
This host is not a documented Baileys or WhatsApp endpoint. By placing the obfuscated URL reconstruction inside the message-send code path, the attacker ensured that all message send operations from an authenticated WhatsApp session would reach the attacker-controlled third-party host in addition to (or instead of) legitimate WhatsApp infrastructure.
The obfuscation technique and placement within a session-privileged send operation indicates intent to covertly relay or exfiltrate caller messaging data through the author's endpoint without user knowledge or consent.
The vulnerability was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-ff82-56mj-77vq.
Indicators of compromise
- Packages
- santana-baileys
- Domains
- fiora.nixel.my.id
Remediation
- Remove santana-baileys from all projects immediately
- Audit npm dependencies for other suspicious forks or packages from the same author
- If WhatsApp messaging was conducted through santana-baileys, assume session compromise and rotate WhatsApp credentials
- Use the official Baileys library (https://github.com/WhiskeySockets/Baileys) or other well-maintained, audited WhatsApp client libraries instead
- Review npm audit logs and package.json lock files to identify when santana-baileys was installed and which versions were used
Sources
- GitHub Advisory GHSA-ff82-56mj-77vq · GitHub Advisory Database
Cite this entry
"Malicious code in santana-baileys (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-santana-baileys-npm-eb5jcu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in a.poltoradnev-package-a
The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in @zynkit/probe
Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in bcs-core
The npm package bcs-core was found to contain malware, resulting in full system compromise for any computer with the package installed or running. All secrets and keys should be rotated immediately from a different computer, and the package should be removed.
npmCompromised package