{"id":"MAL-2026-18441","kind":"package","aliases":["MAL-2026-18441"],"related":[],"title":"Malicious code in @bil-rgb/baileys (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f)\npackage.json for @bil-rgb/baileys@1.0.0 declares its `libsignal` dependency as `github:tenka-san/libsignal-node` with no commit SHA, no tag, and no integrity check. `npm install` resolves this value by cloning whatever currently exists at HEAD of that personal GitHub user's repository and running any lifecycle scripts contained in it. The resolution target is a personal user account unrelated to the upstream signalapp/libsignal-node or WhiskeySockets Baileys publisher, so the code that executes on an installer's machine at install time is whatever that account chooses to place in the referenced branch at the moment of install, independent of this package's own tarball contents. The remainder of the package body (lib/Utils/generics.js and surrounding files) is a Baileys fork; the install-time attacker control is produced by the manifest line itself.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@bil-rgb/baileys","fixed":[],"affected":"= 1.0.0; = 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T01:41:43+00:00","first_seen_at":"2026-11-02T03:31:19+00:00","triaged_at":"2026-11-02T03:33:51+00:00","updated_at":"2026-11-02T03:33:51+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18441':11A,14A '-2026':10A,13A '/baileys':7A,18A,40C '/libsignal-node':51C '1.0.0':41C '3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f':34C 'account':96C,122C 'amazon':32C 'amazon-inspector':31C 'attack':161C 'bailey':104C,155C 'bil':5A,16A,38C 'bil-rgb':4A,15A,37C 'bodi':148C 'branch':129C 'check':61C 'choos':123C 'clone':68C 'code':2A,108C 'commit':54C 'contain':86C 'content':142C 'control':162C 'current':70C 'declar':42C 'depend':45C 'detail':23C 'edit':26C 'execut':110C 'exist':71C 'file':152C 'fork':156C 'github':47C,77C 'head':73C 'independ':135C 'inspector':33C 'instal':63C,113C,117C,134C,159C 'install-tim':158C 'integr':60C 'lib/utils/generics.js':149C 'libsign':44C 'lifecycl':84C 'line':29C,168C 'machin':115C 'mal':9A,12A 'malici':1A,19B 'manifest':167C 'moment':132C 'npm':8A,62C 'packag':20B,138C,147C 'package.json':35C 'per':21C 'person':76C,94C 'place':125C 'produc':164C 'publish':105C 'referenc':128C 'remaind':144C 'repositori':80C 'resolut':90C 'resolv':64C 'rgb':6A,17A,39C 'run':82C 'san':50C 'script':85C 'sha':55C 'signalapp/libsignal-node':101C 'sourc':22C,30C 'surround':151C 'tag':57C 'tarbal':141C 'target':91C 'tenka':49C 'tenka-san':48C 'time':118C,160C 'unrel':97C 'upstream':100C 'user':78C,95C 'valu':66C 'whatev':69C,120C 'whiskeysocket':103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["baileys"],"ptokens":["baileys","bil","rgb"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T01:41:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18441","url":"https://osv.dev/vulnerability/MAL-2026-18441","severity":"critical","published_at":"2026-11-02T01:41:43+00:00","modified_at":"2026-11-02T02:30:05+00:00","first_seen_at":"2026-11-02T03:31:19+00:00","fetched_at":"2026-11-02T03:31:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}