Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in ynastore-baileys (npm)

ynastore-baileys, a fork of the Baileys WhatsApp library on npm, contained malicious code that exfiltrated message data to an attacker-controlled domain (fiora.nixel.my.id) during normal message sending operations. The malicious endpoint was obfuscated using decimal char-code encoding to evade source inspection.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All consumers of ynastore-baileys npm package
Ecosystems
Attack vectors
Affected entities
  • ynastore-baileysFork of Baileys WhatsApp library containing malicious code

ynastore-baileys is a fork of the Baileys WhatsApp library published on npm. Security analysis identified malicious code in lib/Socket/messages-send.js at lines 425 and 436 that reconstructs a network destination using String.fromCharCode() with a decimal char-code array, decoding to https://fiora.nixel.my.id/.

The use of char-code encoding to obfuscate a network host is a known exfiltration pattern designed to hide the malicious endpoint from source-tree inspection. The domain fiora.nixel.my.id is not associated with Baileys or WhatsApp, and the messages-send code path is invoked during the library's normal message sending flow.

This means message-related data from all consumers of this package would be silently routed to the attacker-controlled destination during ordinary use. The incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • ynastore-baileys
Domains
  • fiora.nixel.my.id

Remediation

  • Immediately remove ynastore-baileys from all dependencies
  • Audit any systems that installed ynastore-baileys for data exfiltration to fiora.nixel.my.id
  • Use the legitimate Baileys library (github.com/WhiskeySockets/Baileys) instead
  • Review npm audit logs for installation of ynastore-baileys and identify affected projects
  • Monitor network traffic for connections to fiora.nixel.my.id from systems that may have used this package

Sources

  1. GitHub Advisory GHSA-wv6v-7p37-mx4j · GitHub Advisory Database

Cite this entry

"Malicious code in ynastore-baileys (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ynastore-baileys-npm-1wmbpm

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

  1. resolvedcritical

    Malicious code in rust-testing-utils (npm)

    The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in @syncraft-labs/core (npm)

    The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in nodeberlin (npm)

    The npm package nodeberlin contained malicious code that captured clipboard contents and screenshots, exfiltrating them to a hardcoded attacker-controlled endpoint. The package auto-downloaded Python dependencies and established global hotkeys for screen capture and data relay.

    npmMalicious commit
  4. resolvedcritical

    Malicious code in dxr-dos (npm)

    The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.

    npmCompromised packageMalicious commit