@kelvdra/baileys@1.0.6-rc.6

Summary

package.json declares libsignal as github:Kelvdra/libsignal — an off-registry, mutable git source with no commit SHA, no version pin, and no integrity check. On npm install, npm fetches whatever the referenced GitHub tree contains at that moment and installs it, executing any lifecycle scripts (preinstall/install/postinstall/prepare) the fetched repository declares. Whoever controls the Kelvdra/libsignal repository controls arbitrary code execution on the installer's machine at install time. The dependency name libsignal also mirrors the well-known WhatsApp/Signal library commonly consumed via the Baileys ecosystem, but resolution is redirected to an author-owned GitHub tree rather than a pinned registry release. The static ping rule hit in lib/Utils/generics.js is a keyword co-occurrence in an ID/version generation helper and does not itself indicate exfiltration.

Source: amazon-inspector (96f3f702084444337d5c3a9bc2b0945ecb49960a49e01008f2b3d381664310ba)