noverojava@1.1.0

Summary

package.json declares the runtime dependency libsignal as github:tenka-san/libsignal-node rather than a registry version range or pinned commit SHA. On npm install, npm fetches the current HEAD of that fork's default branch and executes any lifecycle scripts it defines. The fork is under a third-party GitHub account (not the upstream WhiskeySockets libsignal-node maintainer), has no commit pin, and no integrity check, so whoever controls that account controls code that runs on the installer's machine at install time. The package presents as a Baileys/WhatsApp library fork; the static match on lib/Utils/generics.js line 403 (ping/GET tokens) is consistent with normal Baileys network code and is not independently indicative of exfiltration.

Source: amazon-inspector (a7fbf0d1519b05868b34e9e2c1d3588a0596003a5cb53e4cd28fd3a856ecff26)