MAL-2026-19219

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wanzforme/bails4u/MAL-2026-19219.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19219
Published
2026-11-13T03:31:29Z
Modified
2026-11-13T03:45:11Z
Summary
Malicious code in @wanzforme/bails4u (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437)

package.json declares a runtime dependency libsignal with the source github:wanzchil/libsignal-node. The reference has no commit SHA, tag, or integrity hash, so npm install resolves whatever the referenced repository's default branch currently contains and executes any lifecycle scripts bundled with it on the installer's machine. The owner of wanzchil/libsignal-node can push new commits at any time, and future installs will fetch and run those bytes with no version pin and no verification — fully bypassing the npm registry's integrity model for this dependency. A separate static match in lib/Utils/generics.js around a ping/HTTP pattern is consistent with WhatsApp/Baileys-style network utilities and is not independently indicative of malice.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022674",
            "import_time": "2026-11-13T03:36:32.95034552Z",
            "modified_time": "2026-11-13T03:31:29Z",
            "sha256": "7db6d4bfe675bbaa2043f2958993761070ab6e5a09572d884082465b51bdf437",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wanzforme/bails4u

Package

Name
@wanzforme/bails4u
View open source insights on deps.dev
Purl
pkg:npm/%40wanzforme/bails4u

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "e52bf6e63951ba0b2593b790472f1a53501ce09930422361777d223d675df4bc",
            "tlsh": "2a91eb74cd18cea30ac626e865bc4142a47858139ec5f84cb35947ac8f4e25f72baf2d"
        }
    ],
    "package_integrity": [
        {
            "filename": "bails4u-1.0.0.tgz",
            "hashes": {
                "sha1": "73a8a99307e36ed8528ce996abc0bdeb66469de3",
                "sha512_sri": "sha512-SXRxtdXa9a++txrErzin4HNnt76FHtjmCcvEb/J97QQTFuTXlWjpTjsDRVM9y3MHOzldK36EUtHLE221gXyTnA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wanzforme/bails4u/MAL-2026-19219.json"