alipclutch-baileys@8.6.87

Summary

This Baileys fork modifies the outgoing WhatsApp rich-media send path in lib/Socket/messages-send.js so that every image and video preview payload carries a hardcoded sourceUrl attribute pointing to https://fiora.nixel.my.id/. The URL is not present as a string literal — it is assembled at runtime from a decimal-ASCII array via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47), and the associated internal key prefix uses unicode-escaped characters (\u004E\u0049\u0058\u0045\u004C_LATEX_ / _HYPERLINK_ / _CITATION_) so the 'NIXEL'/'fiora' identifiers do not appear in plaintext anywhere else in the package. The advertised purpose of the library is to send WhatsApp messages on behalf of the caller; the caller does not opt into any attribution to fiora.nixel.my.id, and no configuration surface exposes this destination. The behavior is a covert attribution/traffic-attribution side-effect using the caller's WhatsApp session — no credential theft, environment scraping, remote code execution, filesystem persistence, or backdoor is present in this code path; recipients of the caller's messages who click the media preview would be directed to the author-controlled host. The obfuscation choices (charcode-assembled destination plus unicode-escaped brand token) are consistent with deliberate concealment of the destination from source review rather than incidental minification.

Source: amazon-inspector (6bda065ae67b5aebf16879c88d3aa76bdea7775254fc5237ae10b1a67db67c3e)