0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
blurrydespair-libsignal-node
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting blurrydespair-libsignal-node, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-14404 | Unknown | Malicious code in @blurrydespair/libsignal-node (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8) Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require() of the package, index.js schedules install.installNewsletterAutoFollow() via setTimeout; that function locates @whiskeysockets/baileys inside the installer's node_modules and overwrites lib/Socket/newsletter.js with a hardcoded modified copy, then process.exit(0)s. The injected replacement add |
| OSV (opens in a new tab) |
- MAL-2026-14404UnknownMalicious code in @blurrydespair/libsignal-node (npm)
all
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8) Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require() of the package, index.js schedules install.installNewsletterAutoFollow() via setTimeout; that function locates @whiskeysockets/baileys inside the installer's node_modules and overwrites lib/Socket/newsletter.js with a hardcoded modified copy, then process.exit(0)s. The injected replacement add