MAL-2026-16276

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lekzo/baileys/MAL-2026-16276.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16276
Published
2026-09-18T01:40:17Z
Modified
2026-09-18T02:30:06Z
Summary
Malicious code in @lekzo/baileys (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2cd9141ef0d6d97338c5f976c8071a6f5c37010683b27d4463b2221d76b82304)

package.json declares the libsignal dependency as github:canove/libsignal-node with no tag, branch, or commit SHA. On npm install, npm fetches whatever the default branch HEAD of that repository currently points to and runs any lifecycle scripts inside the fetched tree, with no version resolution against the npm registry and no integrity check. The bytes that execute on the installer's machine are entirely controlled by whoever holds write access to that GitHub repo at install time and can change silently between installs.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020172",
            "import_time": "2026-09-18T02:25:26.308382622Z",
            "modified_time": "2026-09-18T01:40:17Z",
            "sha256": "2cd9141ef0d6d97338c5f976c8071a6f5c37010683b27d4463b2221d76b82304",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @lekzo/baileys

Package

Name
@lekzo/baileys
View open source insights on deps.dev
Purl
pkg:npm/%40lekzo/baileys

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "5a0b91acbb96e44456dc68599be20adf19201f573e9f51a98eddf8f0f630e0d4",
            "tlsh": "b991b974cd59cea30a8626ed99bc0141a4b556539ec2f81cb31c07ac8f5e24fb1b9b3d"
        }
    ],
    "package_integrity": [
        {
            "filename": "baileys-0.0.1.tgz",
            "hashes": {
                "sha1": "069ad2b5c1122d2cfb91b34e9ab2ef7392bb5933",
                "sha512_sri": "sha512-nCNkVnTqxuKKMjjDgPW084P2/z70n1+1gL3s52LIlAidfRPxtV5EQJ3HLkOHfXP3VDcTShhQgOr1PV6rp3f1RA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lekzo/baileys/MAL-2026-16276.json"