Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in santana-baileys (npm)

Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All users of affected santana-baileys versions who send WhatsApp messages through the library
Ecosystems
Attack vectors
Affected entities
  • santana-baileysnpm package; fork of Baileys WhatsApp library

The npm package santana-baileys, a fork of the Baileys WhatsApp library, contained malicious code that intercepts authenticated WhatsApp session operations. The malicious code is located in lib/Socket/messages-send.js at lines 425 and 436, where it reconstructs a destination URL from a decimal character-code array using String.fromCharCode(), decoding to https://fiora.nixel.my.id/.

This host is not a documented Baileys or WhatsApp endpoint. By placing the obfuscated URL reconstruction inside the message-send code path, the attacker ensured that all message send operations from an authenticated WhatsApp session would reach the attacker-controlled third-party host in addition to (or instead of) legitimate WhatsApp infrastructure.

The obfuscation technique and placement within a session-privileged send operation indicates intent to covertly relay or exfiltrate caller messaging data through the author's endpoint without user knowledge or consent.

The vulnerability was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-ff82-56mj-77vq.

Indicators of compromise

Packages
  • santana-baileys
Domains
  • fiora.nixel.my.id

Remediation

  • Remove santana-baileys from all projects immediately
  • Audit npm dependencies for other suspicious forks or packages from the same author
  • If WhatsApp messaging was conducted through santana-baileys, assume session compromise and rotate WhatsApp credentials
  • Use the official Baileys library (https://github.com/WhiskeySockets/Baileys) or other well-maintained, audited WhatsApp client libraries instead
  • Review npm audit logs and package.json lock files to identify when santana-baileys was installed and which versions were used

Sources

  1. GitHub Advisory GHSA-ff82-56mj-77vq · GitHub Advisory Database

Cite this entry

"Malicious code in santana-baileys (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-santana-baileys-npm-eb5jcu

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. containedcritical

    Malware in a.poltoradnev-package-a

    The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.

    npmCompromised package
  2. activecritical

    Malware in @zynkit/probe

    Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.

    npmCompromised package
  3. containedcritical

    Malware in leb128x

    The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.

    npmCompromised package
  4. containedcritical

    Malware in bcs-core

    The npm package bcs-core was found to contain malware, resulting in full system compromise for any computer with the package installed or running. All secrets and keys should be rotated immediately from a different computer, and the package should be removed.

    npmCompromised package