{"id":"MAL-2026-18440","summary":"Malicious code in @axo_cuy/baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48)\npackage.json declares a hard dependency `libsignal` with the source `github:tenka-san/libsignal-node`. This is an off-registry dependency source: `npm install` resolves it to the current HEAD of that third-party GitHub repository with no version/commit pin and no integrity check, and executes any lifecycle scripts shipped by that repository on the installer's machine. The owner of `tenka-san/libsignal-node` can change the installed code at any time without republishing this package. The target repository is not the upstream Baileys/libsignal publisher, so installation introduces a third-party code path that bypasses registry review and dependency pinning.\n","modified":"2026-11-02T02:30:05.028918043Z","published":"2026-11-02T01:45:17Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022477","import_time":"2026-11-02T02:17:04.342045069Z","modified_time":"2026-11-02T01:45:17Z","sha256":"0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@axo_cuy/baileys/v/1.0.0"}],"affected":[{"package":{"name":"@axo_cuy/baileys","ecosystem":"npm","purl":"pkg:npm/%40axo_cuy/baileys"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"fb81c930cd58cea30ac526e8a9bd4141a46559139ec5fc1cb35407accf4e15fb1b9b3d","path":"package.json","sha256":"673ed678c3c0f7f9db658c60afcb89e0086607a8063995cf62b40484af244a9b"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@axo_cuy/baileys/MAL-2026-18440.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}