libas-signal

{"modified":"2026-08-19T08:17:38Z","published":"2026-08-19T08:17:38Z","schema_version":"1.7.4","id":"MAL-2026-14291","summary":"Malicious code in libas-signal (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25)\nOn require() of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter.js with a modified copy. The injected code, when the installer later runs their Baileys-based WhatsApp bot, silently issues a FOLLOW newsletterWMexQuery against hardcoded channel 120363407277177688@newsletter using the installer's authenticated WhatsApp session. The patch persists on disk after libas-signal exits and continues to run inside the unrelated dependency. The package's advertised identity (Signal Protocol / Whisper Systems crypto library, with a src/ tree copying Signal Protocol code) is unrelated to this behavior and functions as cover for the dependency-tampering payload.\n","affected":[{"package":{"ecosystem":"npm","name":"libas-signal"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"7422596b00aa76336aca9defb9d7563e9bd4273940d72fd13f8436592665467f","tlsh":"b772b49665fa67a917a37054a63fb0e0b324f243751598627f8cd0020f4a2dce8f3bd8"},{"path":"package.json","sha256":"3ab3e6ad10e661d44a964c849321ac2f45e858484fbefea221131eba80fdfe9e","tlsh":"4cf0a020ce2a9c3301c4ba666c75440a93a21c638945bd0c37c6940c8fae16f67ff77c"}],"package_integrity":[{"filename":"libas-signal-1.0.0.tgz","hashes":{"sha1":"f97f5051adc00971ad05bb8537a8e6dc4733085c","sha512_sri":"sha512-Jgxf5OGKIrJsdj5tGxXf+TQFGavNGXbBTlEx9Rqm0aPjYc9yN0FzicKgB623bzPPpH9C+HiLgtvBe5rteCQO4A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/libas-signal/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018403","import_time":"2026-08-19T08:48:53.343689933Z","modified_time":"2026-08-19T08:17:38Z","sha256":"eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25","source":"amazon-inspector","versions":["1.0.0"]}]}}