@neroxkira/vangal-baileys@1.0.1

Summary

package.json declares libsignal with the source github:RILLYZY/libsignal-node, an unpinned reference to a third-party GitHub repository with no tag or commit SHA. On npm install, npm clones that repository's default branch HEAD and runs any lifecycle scripts contained in it; libsignal-node ships a native addon with build-time scripts. There is no version pin, hash, or integrity check, so whoever controls RILLYZY/libsignal-node controls install-time code execution on every installer of this package. The referenced GitHub account is unrelated to the libsignal upstream (signalapp) and to any publisher identity declared by this package.

Source: amazon-inspector (6af1543fb92f079191de134bd36dbb64c340928804df8486acf43546e2c6e185)