MAL-2026-16389

    Dashboard / Malicious Package / MAL-2026-16389

    MAL-2026-16389

    Published: 22 Sept 2026Last Modified: 22 Sept 2026

    Summary: Malicious code in noverojava (npm)

    Details: Source: amazon-inspector (a7fbf0d1519b05868b34e9e2c1d3588a0596003a5cb53e4cd28fd3a856ecff26) package.json declares the runtime dependency `libsignal` as `github:tenka-san/libsignal-node` rather than a registry version range or pinned commit SHA. On `npm install`, npm fetches the current HEAD of that fork's default branch and executes any lifecycle scripts it defines. The fork is under a third-party GitHub account (not the upstream WhiskeySockets libsignal-node maintainer), has no commit pin, and no integrity check, so whoever controls that account controls code that runs on the installer's machine at install time. The package presents as a Baileys/WhatsApp library fork; the static match on lib/Utils/generics.js line 403 (ping/GET tokens) is consistent with normal Baileys network code and is not independently indicative of exfiltration.

    References: https://www.npmjs.com/package/noverojava/v/1.1.0, https://www.npmjs.com/package/noverojava/v/1.0.9

    Affected packages

    Package

    Name: noverojava

    Purl: pkg:npm/noverojava

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0