Description

The package (a Baileys-family WhatsApp library fork) contains char-code-obfuscated destination strings in lib/Socket/messages-send.js at lines 425 and 436. The byte arrays passed to String.fromCharCode decode to the URL https://fiora.nixel.my.id/, a hardcoded third-party host reconstructed at runtime rather than appearing as a plain string literal. The URL is embedded on the message-send code path, meaning normal use of the library's messaging API routes caller-owned session data through an author-controlled endpoint that is deliberately concealed via char-code obfuscation. Obfuscated destinations in a messaging library's send path have no legitimate purpose and match the covert-relay pattern seen in compromised Baileys forks.

Mitigation

Aliases