Malicious code in zero-baileys (npm)
MAL-2026-16280
Published · Modified
Dependency scanning
Check whether zero-baileys is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (58d472a4390be835fc8ffd5e62a7d3b2bb7270ad6ea651d9cd15bc7abd7735c8)
package.json redirects the libsignal dependency to npm:@otaxayun/libsignal-node@latest. The @latest dist-tag is mutable and unpinned, so each npm install of zero-baileys resolves whatever tarball the @otaxayun scope currently publishes and executes any lifecycle scripts (preinstall/install/postinstall) it contains. Upstream Baileys resolves libsignal from a pinned source; the alias here substitutes an unofficial third-party scope as the trust root for a core cryptographic dependency, with no version pin and no integrity check. The static match on child_process + https.request + POST in lib/Utils/messages-media.js:28 corresponds to media-download helpers in the runtime library and is not itself an install-time exfil path.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes