MAL-2026-14291

    Dashboard / Malicious Package / MAL-2026-14291

    MAL-2026-14291

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in libas-signal (npm)

    Details: Source: amazon-inspector (eeb8f4b0a4f0f66d8a5cfdbc132ec7244b9f9f5948e337dd6b937521663e7c25) On require() of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter.js with a modified copy. The injected code, when the installer later runs their Baileys-based WhatsApp bot, silently issues a FOLLOW newsletterWMexQuery against hardcoded channel 120363407277177688@newsletter using the installer's authenticated WhatsApp session. The patch persists on disk after libas-signal exits and continues to run inside the unrelated dependency. The package's advertised identity (Signal Protocol / Whisper Systems crypto library, with a src/ tree copying Signal Protocol code) is unrelated to this behavior and functions as cover for the dependency-tampering payload.

    References: https://www.npmjs.com/package/libas-signal/v/1.0.0

    Affected packages

    Package

    Name: libas-signal

    Purl: pkg:npm/libas-signal

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0