{"id":"MAL-2026-19219","kind":"package","aliases":["MAL-2026-19219"],"related":[],"title":"Malicious code in @wanzforme/bails4u (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437)\npackage.json declares a runtime dependency `libsignal` with the source `github:wanzchil/libsignal-node`. The reference has no commit SHA, tag, or integrity hash, so `npm install` resolves whatever the referenced repository's default branch currently contains and executes any lifecycle scripts bundled with it on the installer's machine. The owner of wanzchil/libsignal-node can push new commits at any time, and future installs will fetch and run those bytes with no version pin and no verification — fully bypassing the npm registry's integrity model for this dependency. A separate static match in lib/Utils/generics.js around a `ping`/HTTP pattern is consistent with WhatsApp/Baileys-style network utilities and is not independently indicative of malice.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@wanzforme/bails4u","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:31:29+00:00","first_seen_at":"2026-11-13T04:11:34+00:00","triaged_at":"2026-11-13T04:12:29+00:00","updated_at":"2026-11-13T04:12:58+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19219':8A,11A '-2026':7A,10A '/http':123C '7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437':28C 'amazon':26C 'amazon-inspector':25C 'around':120C 'branch':60C 'bundl':68C 'bypass':104C 'byte':95C 'code':2A 'commit':44C,83C 'consist':126C 'contain':62C 'current':61C 'declar':30C 'default':59C 'depend':33C,113C 'detail':17C 'edit':20C 'execut':64C 'fetch':91C 'fulli':103C 'futur':88C 'github':38C 'hash':49C 'independ':134C 'indic':135C 'inspector':27C 'instal':52C,73C,89C 'integr':48C,109C 'lib/utils/generics.js':119C 'libsign':34C 'lifecycl':66C 'line':23C 'machin':75C 'mal':6A,9A 'malic':137C 'malici':1A,13B 'match':117C 'model':110C 'network':129C 'new':82C 'npm':5A,51C,106C 'owner':77C 'packag':14B 'package.json':29C 'pattern':124C 'per':15C 'pin':99C 'ping':122C 'push':81C 'refer':41C 'referenc':56C 'registri':107C 'repositori':57C 'resolv':53C 'run':93C 'runtim':32C 'script':67C 'separ':115C 'sha':45C 'sourc':16C,24C,37C 'static':116C 'tag':46C 'time':86C 'util':130C 'verif':102C 'version':98C 'wanzchil/libsignal-node':39C,79C 'wanzforme/bails4u':4A,12A 'whatev':54C 'whatsapp/baileys-style':128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bails4u"],"ptokens":["bails4u","wanzforme"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19219':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'npm':5A 'wanzforme/bails4u':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'/http':123C '7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437':28C 'amazon':26C 'amazon-inspector':25C 'around':120C 'branch':60C 'bundl':68C 'bypass':104C 'byte':95C 'commit':44C,83C 'consist':126C 'contain':62C 'current':61C 'declar':30C 'default':59C 'depend':33C,113C 'detail':17C 'edit':20C 'execut':64C 'fetch':91C 'fulli':103C 'futur':88C 'github':38C 'hash':49C 'independ':134C 'indic':135C 'inspector':27C 'instal':52C,73C,89C 'integr':48C,109C 'lib/utils/generics.js':119C 'libsign':34C 'lifecycl':66C 'line':23C 'machin':75C 'malic':137C 'match':117C 'model':110C 'network':129C 'new':82C 'npm':51C,106C 'owner':77C 'package.json':29C 'pattern':124C 'per':15C 'pin':99C 'ping':122C 'push':81C 'refer':41C 'referenc':56C 'registri':107C 'repositori':57C 'resolv':53C 'run':93C 'runtim':32C 'script':67C 'separ':115C 'sha':45C 'sourc':16C,24C,37C 'static':116C 'tag':46C 'time':86C 'util':130C 'verif':102C 'version':98C 'wanzchil/libsignal-node':39C,79C 'whatev':54C 'whatsapp/baileys-style':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:31:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19219","url":"https://osv.dev/vulnerability/MAL-2026-19219","severity":"critical","published_at":"2026-11-13T03:31:29+00:00","modified_at":"2026-11-13T03:45:11+00:00","first_seen_at":"2026-11-13T04:11:34+00:00","fetched_at":"2026-11-13T04:11:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}