MAL-2026-18441

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bil-rgb/baileys/MAL-2026-18441.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18441
Published
2026-11-02T01:41:43Z
Modified
2026-11-02T02:30:05Z
Summary
Malicious code in @bil-rgb/baileys (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f)

package.json for @bil-rgb/baileys@1.0.0 declares its libsignal dependency as github:tenka-san/libsignal-node with no commit SHA, no tag, and no integrity check. npm install resolves this value by cloning whatever currently exists at HEAD of that personal GitHub user's repository and running any lifecycle scripts contained in it. The resolution target is a personal user account unrelated to the upstream signalapp/libsignal-node or WhiskeySockets Baileys publisher, so the code that executes on an installer's machine at install time is whatever that account chooses to place in the referenced branch at the moment of install, independent of this package's own tarball contents. The remainder of the package body (lib/Utils/generics.js and surrounding files) is a Baileys fork; the install-time attacker control is produced by the manifest line itself.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022476",
            "import_time":  "2026-11-02T02:17:04.269697497Z",
            "modified_time":  "2026-11-02T01:41:55Z",
            "sha256":  "3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-022475",
            "import_time":  "2026-11-02T02:17:04.198949925Z",
            "modified_time":  "2026-11-02T01:41:43Z",
            "sha256":  "748ce601bf34ec5b40cccc2c1642cff8df916ebab398bf08aebbe84f7adae1ef",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @bil-rgb/baileys

Package

Name
@bil-rgb/baileys
View open source insights on deps.dev
Purl
pkg:npm/%40bil-rgb/baileys

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "9fc1939afe1f73f8cd1983132911e6857d53725074dba05a53edadc96007506a",
            "tlsh":  "8981d974cd58cea30ac526e8a9bc4142a4b559139ec1f81cb35507ac8f5e24f72b9b3e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "baileys-1.0.0.tgz",
            "hashes":  {
                "sha1":  "4628c4a78b720aa70a363b04b2a0353d39932706",
                "sha512_sri":  "sha512-sY4bkKgu0XKisu1UujLQdf112Ho1Q3xUZK3ghdGrmdnFn3BCpzyVviMQnZa+LzemLImFAVB3QfuOb+ckCZX1FA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bil-rgb/baileys/MAL-2026-18441.json"