{"id":"MAL-2026-18491","summary":"Malicious code in @corexium/xbails (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729)\npackage.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag: \"libsignal\": \"npm:@bellaxchuu/libsignal-node@latest\". The code imports 'libsignal' at module load time for end-to-end-encryption primitives (SessionCipher, SessionRecord, ProtocolAddress, SessionBuilder in lib/Signal/libsignal.js and lib/Signal/curve.js). Each install resolves whatever the owner of @bellaxchuu/libsignal-node has published to @latest, with no version pin, no integrity check, and no provenance tie to the upstream libsignal-node project. The maintainer of the aliased fork therefore controls arbitrary code that runs at require/import time of this package, including inside the cryptographic session-handling path.\n","modified":"2026-11-03T03:45:04.133972116Z","published":"2026-11-03T03:35:28Z","database_specific":{"malicious-packages-origins":[{"sha256":"7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729","source":"amazon-inspector","versions":["0.0.7"],"id":"IN-MAL-2026-022514","import_time":"2026-11-03T03:37:00.579908611Z","modified_time":"2026-11-03T03:35:28Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@corexium/xbails/v/0.0.7"}],"affected":[{"package":{"name":"@corexium/xbails","ecosystem":"npm","purl":"pkg:npm/%40corexium/xbails"},"versions":["0.0.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@corexium/xbails/MAL-2026-18491.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"a5d1e8735b9191d374fa73f51588f2e7c8b2f53dd29c895638ded5b17ae94a57","tlsh":"e081da34cd18cea30ac526e9a9bd0042a4b558539ec1fc1cb35947ac8f0e25fb1b9b2d","path":"package.json"}],"package_integrity":[{"filename":"xbails-0.0.7.tgz","hashes":{"sha512_sri":"sha512-D1xdYjdr/8PT9coaD3+ZjpIGXzcFr9lqA9AYGmlS4Bevzzxv9xsb/+Bhjja5M5NyWJqbEGobcMKJmno4evmcSw==","sha1":"0251265ff7cc854f13a3756018cfac37991d7ddf"}}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}