MAL-2026-14291

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/libas-signal/MAL-2026-14291.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14291
Published
2026-08-19T08:17:38Z
Modified
2026-08-19T09:00:19.346200885Z
Summary
Malicious code in libas-signal (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25)

On require() of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter.js with a modified copy. The injected code, when the installer later runs their Baileys-based WhatsApp bot, silently issues a FOLLOW newsletterWMexQuery against hardcoded channel 120363407277177688@newsletter using the installer's authenticated WhatsApp session. The patch persists on disk after libas-signal exits and continues to run inside the unrelated dependency. The package's advertised identity (Signal Protocol / Whisper Systems crypto library, with a src/ tree copying Signal Protocol code) is unrelated to this behavior and functions as cover for the dependency-tampering payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T08:48:53.343689933Z",
            "sha256": "eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25",
            "modified_time": "2026-08-19T08:17:38Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018403",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / libas-signal

Package

Name
libas-signal
View open source insights on deps.dev
Purl
pkg:npm/libas-signal

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/libas-signal/MAL-2026-14291.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "7422596b00aa76336aca9defb9d7563e9bd4273940d72fd13f8436592665467f",
            "path": "install.js",
            "tlsh": "b772b49665fa67a917a37054a63fb0e0b324f243751598627f8cd0020f4a2dce8f3bd8"
        },
        {
            "sha256": "3ab3e6ad10e661d44a964c849321ac2f45e858484fbefea221131eba80fdfe9e",
            "tlsh": "4cf0a020ce2a9c3301c4ba666c75440a93a21c638945bd0c37c6940c8fae16f67ff77c",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "libas-signal-1.0.0.tgz",
            "hashes": {
                "sha1": "f97f5051adc00971ad05bb8537a8e6dc4733085c",
                "sha512_sri": "sha512-Jgxf5OGKIrJsdj5tGxXf+TQFGavNGXbBTlEx9Rqm0aPjYc9yN0FzicKgB623bzPPpH9C+HiLgtvBe5rteCQO4A=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]