@axo_cuy/baileys

{"modified":"2026-11-02T01:45:17Z","published":"2026-11-02T01:45:17Z","schema_version":"1.7.4","id":"MAL-2026-18440","summary":"Malicious code in @axo_cuy/baileys (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48)\npackage.json declares a hard dependency `libsignal` with the source `github:tenka-san/libsignal-node`. This is an off-registry dependency source: `npm install` resolves it to the current HEAD of that third-party GitHub repository with no version/commit pin and no integrity check, and executes any lifecycle scripts shipped by that repository on the installer's machine. The owner of `tenka-san/libsignal-node` can change the installed code at any time without republishing this package. The target repository is not the upstream Baileys/libsignal publisher, so installation introduces a third-party code path that bypasses registry review and dependency pinning.\n","affected":[{"package":{"ecosystem":"npm","name":"@axo_cuy/baileys"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"673ed678c3c0f7f9db658c60afcb89e0086607a8063995cf62b40484af244a9b","tlsh":"fb81c930cd58cea30ac526e8a9bd4141a46559139ec5fc1cb35407accf4e15fb1b9b3d"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@axo_cuy/baileys/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022477","import_time":"2026-11-02T02:17:04.342045069Z","modified_time":"2026-11-02T01:45:17Z","sha256":"0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48","source":"amazon-inspector","versions":["1.0.0"]}]}}