@neroxkira/vangal-baileys@1.0.0: Malicious npm security report

OSV Malicious Advisory

imported 1mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16103 confirms this npm version as malicious. package.json declares `libsignal` with the source `github:RILLYZY/libsignal-node`, an unpinned reference to a third-party GitHub repository with no tag or commit SHA. On `npm install`, npm clones that repository's default branch HEAD and runs any lifecycle scripts contained in it; libsignal-node ships a native addon with build-time scripts...

Advisory

MAL-2026-16103

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @neroxkira/vangal-baileys (npm)

Details

package.json declares `libsignal` with the source `github:RILLYZY/libsignal-node`, an unpinned reference to a third-party GitHub repository with no tag or commit SHA. On `npm install`, npm clones that repository's default branch HEAD and runs any lifecycle scripts contained in it; libsignal-node ships a native addon with build-time scripts. There is no version pin, hash, or integrity check, so whoever controls RILLYZY/libsignal-node controls install-time code execution on every installer of this package. The referenced GitHub account is unrelated to the libsignal upstream (signalapp) and to any publisher identity declared by this package.

Decision reason

OpenSSF Malicious Packages via OSV confirms @neroxkira/vangal-baileys@1.0.0 as malicious (MAL-2026-16103): Malicious code in @neroxkira/vangal-baileys (npm)

References

OSV advisory PACKAGE PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

@neroxkira/vangal-baileys@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code