santana-baileys @2.0.4
Vulnerability report · Last retrieved from osv.dev August 7, 2026 at 2:10 AM UTC
OSV ID
MAL-2026-13456
Ecosystem
npm
Summary
santana-baileys is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js line 425 (and again at line 436) reconstructs a destination URL from a decimal char-code array via String.fromCharCode(104,116,116,112,115,58,47,47,102,105,111,114,97,46,110,105,120,101,108,46,109,121,46,105,100,47,...), which decodes to https://fiora.nixel.my.id/. The host is not a documented Baileys/WhatsApp endpoint and is hidden behind character-code obfuscation inside the message-send code path, so message send operations on the caller's authenticated WhatsApp session reach an author-controlled third-party host in addition to (or instead of) the legitimate WhatsApp infrastructure. Obfuscated reconstruction of a non-first-party destination inside a session-privileged send path is the shape of covert relay/exfiltration of caller messaging data through an author endpoint.
Source: amazon-inspector (a01fc218f60217e160355fc41c6006c25da2197ea1fec2b3402df38e125e4252)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.