{"id":"MAL-2026-19219","summary":"Malicious code in @wanzforme/bails4u (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437)\npackage.json declares a runtime dependency `libsignal` with the source `github:wanzchil/libsignal-node`. The reference has no commit SHA, tag, or integrity hash, so `npm install` resolves whatever the referenced repository's default branch currently contains and executes any lifecycle scripts bundled with it on the installer's machine. The owner of wanzchil/libsignal-node can push new commits at any time, and future installs will fetch and run those bytes with no version pin and no verification — fully bypassing the npm registry's integrity model for this dependency. A separate static match in lib/Utils/generics.js around a `ping`/HTTP pattern is consistent with WhatsApp/Baileys-style network utilities and is not independently indicative of malice.\n","modified":"2026-11-13T03:45:11.441077588Z","published":"2026-11-13T03:31:29Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022674","import_time":"2026-11-13T03:36:32.95034552Z","modified_time":"2026-11-13T03:31:29Z","sha256":"7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wanzforme/bails4u/v/1.0.0"}],"affected":[{"package":{"name":"@wanzforme/bails4u","ecosystem":"npm","purl":"pkg:npm/%40wanzforme/bails4u"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"73a8a99307e36ed8528ce996abc0bdeb66469de3","sha512_sri":"sha512-SXRxtdXa9a++txrErzin4HNnt76FHtjmCcvEb/J97QQTFuTXlWjpTjsDRVM9y3MHOzldK36EUtHLE221gXyTnA=="},"filename":"bails4u-1.0.0.tgz"}],"evidence_files":[{"sha256":"e52bf6e63951ba0b2593b790472f1a53501ce09930422361777d223d675df4bc","tlsh":"2a91eb74cd18cea30ac626e865bc4142a47858139ec5f84cb35947ac8f4e25f72baf2d","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wanzforme/bails4u/MAL-2026-19219.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}