OpenSSF/OSV advisory MAL-2026-14291 confirms this npm version as malicious. On require() of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter.js with a modified copy...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in libas-signal (npm)
Details
On require() of libas-signal, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter.js with a modified copy. The injected code, when the installer later runs their Baileys-based WhatsApp bot, silently issues a FOLLOW newsletterWMexQuery against hardcoded channel 120363407277177688@newsletter using the installer's authenticated WhatsApp session. The patch persists on disk after libas-signal exits and continues to run inside the unrelated dependency. The package's advertised identity (Signal Protocol / Whisper Systems crypto library, with a src/ tree copying Signal Protocol code) is unrelated to this behavior and functions as cover for the dependency-tampering payload.
Decision reason
OpenSSF Malicious Packages via OSV confirms libas-signal@1.0.0 as malicious (MAL-2026-14291): Malicious code in libas-signal (npm)