Malicious code in libas-signal (npm)
libas-signal, an npm package masquerading as a Signal Protocol library, contained malicious code that on require() injects a modified version of @whiskeysockets/baileys' Socket/newsletter.js to silently issue WhatsApp newsletter follow commands using the installer's authenticated session.
- Disclosed
- Last updated
- Blast radius
- Developers who installed libas-signal and used it in projects with @whiskeysockets/baileys dependency; WhatsApp bot operators using affected Baileys installations.
- Ecosystems
- Attack vectors
- Affected entities
- libas-signalnpm package containing malicious code that injects payload into @whiskeysockets/baileys
libas-signal is an npm package that falsely advertised itself as a Signal Protocol / Whisper Systems cryptographic library, complete with copied Signal Protocol source code as cover. Upon being required in a Node.js application, the package's index.js scheduled execution of install.js, which located the @whiskeysockets/baileys package on the installer's disk and overwrote its lib/Socket/newsletter.js file with a malicious modified version.\n\nThe injected code persists on disk and executes when the installer later runs their Baileys-based WhatsApp bot. It silently issues a FOLLOW newsletterWMexQuery command against a hardcoded WhatsApp channel (120363407277177688@newsletter) using the installer's authenticated WhatsApp session, without the user's knowledge or consent.\n\nThe malicious behavior is unrelated to the package's advertised purpose and functions as a dependency-tampering attack that compromises unrelated downstream dependencies. The attack was identified by the OpenSSF's malicious-packages project and assigned identifier MAL-2026-14291.\n\nDevelopers who installed libas-signal should immediately remove it and audit their @whiskeysockets/baileys installations for the injected code.
Indicators of compromise
- Packages
- libas-signal
- Domains
- 120363407277177688@newsletter
Remediation
- Remove libas-signal from all projects immediately
- Audit @whiskeysockets/baileys installations for modified lib/Socket/newsletter.js files
- Restore @whiskeysockets/baileys to a clean state from npm registry or rebuild from source
- Review WhatsApp bot logs for unauthorized FOLLOW commands issued to channel 120363407277177688@newsletter
- Rotate WhatsApp session credentials if the bot was active during the compromise period
- Check npm audit and dependency scanning tools for any remaining instances of libas-signal
Sources
- GitHub Advisory GHSA-848j-6p9v-h8g3 · GitHub Advisory Database
Cite this entry
"Malicious code in libas-signal (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-libas-signal-npm-3o90ey
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit