@modss/baileys@2.0.0

Summary

package.json declares a runtime dependency libsignal whose source is github:RILLYZY/libsignal-node — a GitHub reference with no commit SHA, tag, or version pin. On npm install, npm fetches whatever HEAD of that personal repository currently returns and runs any lifecycle scripts it contains on the installer's machine, with no integrity check. Whoever controls that GitHub account controls code that executes on any machine installing @modss/baileys, and the fetched content can change silently between installs. The named dependency also shadows the legitimate libsignal cryptographic library, meaning callers of the package's signal-protocol paths load code from the unpinned third-party fork rather than a registry-audited artifact.

Source: amazon-inspector (0b6522f1f967259853346030f220d40ef098fc3d54116a23161fb4ccf97f9bd3)