{"id":"MAL-2026-16280","summary":"Malicious code in zero-baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (58d472a4390be835fc8ffd5e62a7d3b2bb7270ad6ea651d9cd15bc7abd7735c8)\npackage.json redirects the `libsignal` dependency to `npm:@otaxayun/libsignal-node@latest`. The `@latest` dist-tag is mutable and unpinned, so each `npm install` of zero-baileys resolves whatever tarball the `@otaxayun` scope currently publishes and executes any lifecycle scripts (preinstall/install/postinstall) it contains. Upstream Baileys resolves libsignal from a pinned source; the alias here substitutes an unofficial third-party scope as the trust root for a core cryptographic dependency, with no version pin and no integrity check. The static match on `child_process` + `https.request` + `POST` in lib/Utils/messages-media.js:28 corresponds to media-download helpers in the runtime library and is not itself an install-time exfil path.\n","modified":"2026-09-18T03:30:06.060131829Z","published":"2026-09-18T02:54:59Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020174","import_time":"2026-09-18T03:21:12.884821978Z","modified_time":"2026-09-18T02:54:59Z","sha256":"58d472a4390be835fc8ffd5e62a7d3b2bb7270ad6ea651d9cd15bc7abd7735c8","source":"amazon-inspector","versions":["2.7.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zero-baileys/v/2.7.0"}],"affected":[{"package":{"name":"zero-baileys","ecosystem":"npm","purl":"pkg:npm/zero-baileys"},"versions":["2.7.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zero-baileys/MAL-2026-16280.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"62361bc2630bfc92a637fee054790863fb028643a109b416935676aabd5e3fbc","tlsh":"6551db25cc6cceb314c636eaa9b65101507841934d95fc2c376c0bad4f5e2af32b9b2e","path":"package.json"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-uZpc59vM1hgwTnehNOSaeyCu21S/NwyvUWxrFA7cN+HI0qj+vh18IQSp7tdh2xoc5t5OPpOO9igSLV1IRJXVuQ==","sha1":"ca42a699d809984d97d13e06909cc491addd5a87"},"filename":"zero-baileys-2.7.0.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}