@lekzo/baileys@0.0.7: Malicious npm security report (Block)

OSV Malicious Advisory

imported 16d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16276 confirms this npm version as malicious. package.json declares the `libsignal` dependency as `github:canove/libsignal-node` — a bare GitHub owner/repo reference with no commit SHA, tag, or semver version. On `npm install`, this resolves to whatever the current HEAD of that third-party repository points at, fetching and installing arbitrary code with no integrity check and running any lifecycle scripts inside the returned bytes...

Advisory

MAL-2026-16276

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @lekzo/baileys (npm)

Details

package.json declares the `libsignal` dependency as `github:canove/libsignal-node` — a bare GitHub owner/repo reference with no commit SHA, tag, or semver version. On `npm install`, this resolves to whatever the current HEAD of that third-party repository points at, fetching and installing arbitrary code with no integrity check and running any lifecycle scripts inside the returned bytes. Whoever controls that GitHub repository at any future moment controls code executed on every installer of this package. The static `ping`/`GET` co-occurrence in lib/Utils/generics.js is unrelated to this finding.

Decision reason

OpenSSF Malicious Packages via OSV confirms @lekzo/baileys@0.0.7 as malicious (MAL-2026-16276): Malicious code in @lekzo/baileys (npm)

References

OSV advisory PACKAGE PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

@lekzo/baileys@0.0.7

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code