Malicious code in ynastore-baileys (npm)
ynastore-baileys, a fork of the Baileys WhatsApp library on npm, contained malicious code that exfiltrated message data to an attacker-controlled domain (fiora.nixel.my.id) during normal message sending operations. The malicious endpoint was obfuscated using decimal char-code encoding to evade source inspection.
- Disclosed
- Last updated
- Blast radius
- All consumers of ynastore-baileys npm package
- Ecosystems
- Attack vectors
- Affected entities
- ynastore-baileysFork of Baileys WhatsApp library containing malicious code
ynastore-baileys is a fork of the Baileys WhatsApp library published on npm. Security analysis identified malicious code in lib/Socket/messages-send.js at lines 425 and 436 that reconstructs a network destination using String.fromCharCode() with a decimal char-code array, decoding to https://fiora.nixel.my.id/.
The use of char-code encoding to obfuscate a network host is a known exfiltration pattern designed to hide the malicious endpoint from source-tree inspection. The domain fiora.nixel.my.id is not associated with Baileys or WhatsApp, and the messages-send code path is invoked during the library's normal message sending flow.
This means message-related data from all consumers of this package would be silently routed to the attacker-controlled destination during ordinary use. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- ynastore-baileys
- Domains
- fiora.nixel.my.id
Remediation
- Immediately remove ynastore-baileys from all dependencies
- Audit any systems that installed ynastore-baileys for data exfiltration to fiora.nixel.my.id
- Use the legitimate Baileys library (github.com/WhiskeySockets/Baileys) instead
- Review npm audit logs for installation of ynastore-baileys and identify affected projects
- Monitor network traffic for connections to fiora.nixel.my.id from systems that may have used this package
Sources
- GitHub Advisory GHSA-wv6v-7p37-mx4j · GitHub Advisory Database
Cite this entry
"Malicious code in ynastore-baileys (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ynastore-baileys-npm-1wmbpm
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in nodeberlin (npm)
The npm package nodeberlin contained malicious code that captured clipboard contents and screenshots, exfiltrating them to a hardcoded attacker-controlled endpoint. The package auto-downloaded Python dependencies and established global hotkeys for screen capture and data relay.
npmMalicious commit - resolvedcritical
Malicious code in dxr-dos (npm)
The npm package dxr-dos contains malicious code that executes arbitrary code via a mutable third-party dependency (deathoffather-project) and extracts a hidden PHP C2 panel from a password-protected archive. The package is advertised as a DDoS toolkit with command-and-control capabilities.
npmCompromised packageMalicious commit