MAL-2026-13931

    Dashboard / Malicious Package / MAL-2026-13931

    MAL-2026-13931

    Published: 10 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @dreamguyxeon/libsignal-node (npm)

    Details: npm/@dreamguyxeon/libsignal-node has the same import-time supply-chain tampering as @dgxeon13/[email protected]: on require it patches @whiskeysockets/baileys lib/Socket/newsletter.js with remote-controlled consentless WhatsApp newsletter auto-follow code (fetch DGXeon13/strings after 120s, silent FOLLOW). Used as the libsignal npm alias dependency from [email protected]. Related campaign OSV: MAL-2026-2252, MAL-2025-806. Tarball sha256: 41906336d7a9cbf416ca8ac3e01af4ffad13a1048cd306390734fa18a061ba8c.

    References: https://www.npmjs.com/package/@dreamguyxeon/libsignal-node, https://osv.dev/vulnerability/MAL-2026-2252, https://osv.dev/vulnerability/MAL-2025-806, https://safedep.io/malicious-baileys-npm-whatsapp-campaign/

    Affected packages

    Package

    Name: @dreamguyxeon/libsignal-node

    Purl: pkg:npm/%40dreamguyxeon/libsignal-node

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1