Malicious code in @lekzo/baileys (npm)
MAL-2026-16276
Published · Modified
Dependency scanning
Check whether @lekzo/baileys is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (2cd9141ef0d6d97338c5f976c8071a6f5c37010683b27d4463b2221d76b82304)
package.json declares the libsignal dependency as github:canove/libsignal-node with no tag, branch, or commit SHA. On npm install, npm fetches whatever the default branch HEAD of that repository currently points to and runs any lifecycle scripts inside the fetched tree, with no version resolution against the npm registry and no integrity check. The bytes that execute on the installer's machine are entirely controlled by whoever holds write access to that GitHub repo at install time and can change silently between installs.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes