@mr-supun-fernando/supunmd-bail

{"modified":"2026-09-22T16:05:01Z","published":"2026-09-22T16:05:01Z","schema_version":"1.7.4","id":"MAL-2026-16387","summary":"Malicious code in @mr-supun-fernando/supunmd-bail (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19)\npackage.json declares `\"libsignal\": \"github:tenka-san/libsignal-node\"` — an off-registry dependency source pointing at a personal-user GitHub repository with no commit SHA, no tag, and no integrity check. On `npm install`, npm clones the current tip of that repository and installs whatever it contains, running any lifecycle scripts (`preinstall`/`install`/`postinstall`/`prepare`) inside the fetched tree on the installer's machine. The dependency key `libsignal` shadows the well-known Signal protocol library, but the source is a personal user's fork rather than the upstream signalapp organization, so whoever controls the tenka-san/libsignal-node repository controls install-time code execution on every installer of this package. The source is mutable — content that resolves benign today can be replaced without any change to this package. A secondary observation: lib/Utils/generics.js line 403 references `ping`, but this is unrelated to the primary install-time execution concern.\n","affected":[{"package":{"ecosystem":"npm","name":"@mr-supun-fernando/supunmd-bail"},"versions":["3.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"9c82bd85f81b684e4fe6c918e058de9f66cd66f0c3690456d81de85ae39b4b03","tlsh":"2291a934cd59cea30ac626e9a5bd0106a4655913aec1f81cb36c57ac8f0e24f71b9e3d"}],"package_integrity":[{"filename":"supunmd-bail-3.0.3.tgz","hashes":{"sha1":"272dea75a155531af96778250d44a421f9ef1b57","sha512_sri":"sha512-EUICfLmvIC+NhaA+vDyv4sYJN2BS3qJTwYOUkx2AgkBRCu9IEnq/pnyaTqPGrOgvk9htIBuL+kFx9yoBR3iANA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mr-supun-fernando/supunmd-bail/v/3.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020293","import_time":"2026-09-22T16:19:47.567143454Z","modified_time":"2026-09-22T16:05:01Z","sha256":"86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19","source":"amazon-inspector","versions":["3.0.3"]}]}}