@axo_cuy/baileys@1.0.0
Vulnerability report · Last retrieved from osv.dev November 2, 2026 at 4:14 AM UTC
OSV ID
MAL-2026-18440
Ecosystem
npm
Summary
package.json declares a hard dependency libsignal with the source github:tenka-san/libsignal-node. This is an off-registry dependency source: npm install resolves it to the current HEAD of that third-party GitHub repository with no version/commit pin and no integrity check, and executes any lifecycle scripts shipped by that repository on the installer's machine. The owner of tenka-san/libsignal-node can change the installed code at any time without republishing this package. The target repository is not the upstream Baileys/libsignal publisher, so installation introduces a third-party code path that bypasses registry review and dependency pinning.
Source: amazon-inspector (0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.