MAL-2026-13402

    Dashboard / Malicious Package / MAL-2026-13402

    MAL-2026-13402

    Published: 6 Aug 2026Last Modified: 28 Aug 2026

    Summary: Malicious code in jagproject (npm)

    Details: Source: amazon-inspector (2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced) lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline.

    References: https://www.npmjs.com/package/jagproject/v/28.1.0, https://www.npmjs.com/package/jagproject/v/28.3.0, https://www.npmjs.com/package/jagproject/v/28.2.0, https://www.npmjs.com/package/jagproject/v/28.7.0

    Affected packages

    Package

    Name: jagproject

    Purl: pkg:npm/jagproject

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    28.1.0