@chatunitycenter/baileys@1.0.0

Summary

package.json declares libsignal as github:chatunitycenter/libsignal-node with no commit SHA, tag, or integrity hash. On npm install, npm clones the default-branch HEAD of that repository and installs whatever it returns, including executing any lifecycle scripts (preinstall/install/postinstall/prepare) present in the cloned source. The resolved bytes are mutable: whoever controls the chatunitycenter/libsignal-node repository can push new commits at any time and those commits will run on every installer that resolves this dependency going forward. The dependency key resembles the well-known libsignal-node project but points to an account-controlled fork rather than a registry version range or a pinned commit, so the installer cannot audit or reproduce what will be fetched.

Source: amazon-inspector (23bc43e71e1158fc102445f53b3880fe32a99bb6a8557b99d1b17279e8f41f44)