diezyyasha-baileys @9.2.0

Summary

diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines 425 and 436 the code constructs a URL via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47) which decodes to https://fiora.nixel.my.id/ — a hardcoded third-party host reconstructed from a char-code array rather than a plain string. This destination is embedded inside the message-sending code path of a WhatsApp session library, where the caller has already provided authenticated session credentials and where message content, contacts, and session identifiers are handled. The obfuscated-destination pattern (char-code reconstruction) inside a wallet/messaging-session code path is the exfiltration fingerprint: a first-party integration would use a plain, configurable URL, not a fromCharCode-reconstructed hardcoded host in a fork of an upstream library.

Source: amazon-inspector (1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745)