Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @dgxeon13/libsignal-node (npm)

@dgxeon13/libsignal-node is a malicious npm package that impersonates Signal's libsignal Node binding. Upon require, it executes code that modifies @whiskeysockets/baileys to inject a payload enabling remote-controlled WhatsApp newsletter auto-follow functionality.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Packages depending on @dgxeon13/libsignal-node; downstream consumers of @dreamguyxeon/baileyx that use this malicious alias.
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • @dgxeon13/libsignal-nodeMalicious npm package impersonating Signal's libsignal Node binding

@dgxeon13/libsignal-node is a typosquatting/impersonation package published to npm that mimics Signal's legitimate libsignal Node binding. The package contains malicious code in index.js that, after a short delay on require, executes install.js and calls installNewsletterAutoFollow().\n\nThe malicious payload locates @whiskeysockets/baileys in node_modules and overwrites lib/Socket/newsletter.js with embedded code that performs remote-controlled, consentless WhatsApp newsletter auto-follow operations. The payload fetches commands from DGXeon13/strings after 120 seconds and silently executes FOLLOW actions.\n\nThis represents supply-chain tampering of a third-party package at import time. The package was used as a libsignal alias from @dreamguyxeon/baileyx. The incident is part of a related campaign (OSV: MAL-2026-2252, MAL-2025-806). The tarball SHA256 is 46e4b9fd62489e1e28c88f8ebac77cf0fa6c48639cd6d548bdb097ca6793d157.\n\nThe package has been identified and cataloged by the OpenSSF malicious-packages project (MAL-2026-13929).

Indicators of compromise

Packages
  • @dgxeon13/libsignal-node
Hashes
  • 46e4b9fd62489e1e28c88f8ebac77cf0fa6c48639cd6d548bdb097ca6793d157

Remediation

  • Remove @dgxeon13/libsignal-node from all dependencies immediately
  • Audit package-lock.json and yarn.lock for any installations of @dgxeon13/libsignal-node
  • If installed, reinstall node_modules from scratch after removing the malicious package
  • Review @whiskeysockets/baileys lib/Socket/newsletter.js for unauthorized modifications
  • Check for any unexpected WhatsApp newsletter follow activity in accounts using affected packages
  • Use npm audit or similar tools to detect this package in your dependency tree
  • Verify that you are using the legitimate Signal libsignal package from the correct source

Sources

  1. GitHub Advisory GHSA-p8j3-vr93-qgcw · GitHub Advisory Database

Cite this entry

"Malicious code in @dgxeon13/libsignal-node (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-dgxeon13-libsignal-node-npm-9etpgs

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in depcruise-wrap-stream-in-html (npm)

    depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.

    npmCompromised packageDependency confusionTyposquatting
  2. resolvedcritical

    Malicious code in @finaxis/common-js (npm)

    The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.

    npmCompromised packageTyposquatting
  3. resolvedcritical

    Malicious code in akamai-sensor (npm)

    A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.

    npmCompromised packageTyposquatting
  4. resolvedcritical

    Malicious code in wct-st (npm)

    The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.

    npmCompromised packageTyposquatting