Live › package › MAL-2026-18491
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-11-03 04:17 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @corexium/xbails | npm | = 0.0.7 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag: "libsignal": "npm:@bellaxchuu/libsignal-node@latest". The code imports 'libsignal' at module load time for end-to-end-encryption primitives (SessionCipher, SessionRecord, ProtocolAddress, SessionBuilder in lib/Signal/libsignal.js and lib/Signal/curve.js). Each install resolves whatever the owner of @bellaxchuu/libsignal-node has published to @latest, with no version pin, no integrity check, and no provenance tie to the upstream libsignal-node project. The maintainer of the aliased fork therefore controls arbitrary code that runs at require/import time of this package, including inside the cryptographic session-handling path.
This page as .md · .json · in your agent: get_signal("MAL-2026-18491")