{"id":"MAL-2026-16387","summary":"Malicious code in @mr-supun-fernando/supunmd-bail (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19)\npackage.json declares `\"libsignal\": \"github:tenka-san/libsignal-node\"` — an off-registry dependency source pointing at a personal-user GitHub repository with no commit SHA, no tag, and no integrity check. On `npm install`, npm clones the current tip of that repository and installs whatever it contains, running any lifecycle scripts (`preinstall`/`install`/`postinstall`/`prepare`) inside the fetched tree on the installer's machine. The dependency key `libsignal` shadows the well-known Signal protocol library, but the source is a personal user's fork rather than the upstream signalapp organization, so whoever controls the tenka-san/libsignal-node repository controls install-time code execution on every installer of this package. The source is mutable — content that resolves benign today can be replaced without any change to this package. A secondary observation: lib/Utils/generics.js line 403 references `ping`, but this is unrelated to the primary install-time execution concern.\n","modified":"2026-09-22T16:30:07.561171457Z","published":"2026-09-22T16:05:01Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-22T16:19:47.567143454Z","modified_time":"2026-09-22T16:05:01Z","sha256":"86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19","source":"amazon-inspector","versions":["3.0.3"],"id":"IN-MAL-2026-020293"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mr-supun-fernando/supunmd-bail/v/3.0.3"}],"affected":[{"package":{"name":"@mr-supun-fernando/supunmd-bail","ecosystem":"npm","purl":"pkg:npm/%40mr-supun-fernando/supunmd-bail"},"versions":["3.0.3"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"2291a934cd59cea30ac626e9a5bd0106a4655913aec1f81cb36c57ac8f0e24f71b9e3d","path":"package.json","sha256":"9c82bd85f81b684e4fe6c918e058de9f66cd66f0c3690456d81de85ae39b4b03"}],"package_integrity":[{"hashes":{"sha1":"272dea75a155531af96778250d44a421f9ef1b57","sha512_sri":"sha512-EUICfLmvIC+NhaA+vDyv4sYJN2BS3qJTwYOUkx2AgkBRCu9IEnq/pnyaTqPGrOgvk9htIBuL+kFx9yoBR3iANA=="},"filename":"supunmd-bail-3.0.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mr-supun-fernando/supunmd-bail/MAL-2026-16387.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}