Live › package › MAL-2026-18441
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @bil-rgb/baileys | npm | = 1.0.0; = 1.0.1 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
package.json for @bil-rgb/[email protected] declares its libsignal dependency as github:tenka-san/libsignal-node with no commit SHA, no tag, and no integrity check. npm install resolves this value by cloning whatever currently exists at HEAD of that personal GitHub user's repository and running any lifecycle scripts contained in it. The resolution target is a personal user account unrelated to the upstream signalapp/libsignal-node or WhiskeySockets Baileys publisher, so the code that executes on an installer's machine at install time is whatever that account chooses to place in the referenced branch at the moment of install, independent of this package's own tarball contents. The remainder of the package body (lib/Utils/generics.js and surrounding files) is a Baileys fork; the install-time attacker control is produced by the manifest line itself.
This page as .md · .json · in your agent: get_signal("MAL-2026-18441")