The @chatunity/baileys package versions 3.2.0 and 3.2.1 depend on a runtime library 'libsignal' fetched directly from a GitHub repository (github:chatunitycenter/libsignal-node) without fixed commit or tag references. This off-registry dependency is mutable and lacks integrity verification, meaning that any changes pushed to the default branch of the repository or a takeover of the GitHub account can result in execution of malicious code during npm install lifecycle scripts. Because the package manager fetches and executes this code transitively without version or artifact changes on npm, this creates a supply chain risk allowing arbitrary code execution on the developer's environment.

This vulnerability enables arbitrary code execution during the installation of the affected package versions, potentially leading to compromise of the developer's environment or build systems. The mutable off-registry dependency without integrity checks means attackers can inject malicious code by modifying the GitHub repository or compromising the account that owns it. There are no known exploits in the wild at this time.

No official patch or remediation is currently documented. Users should avoid using versions 3.2.0 and 3.2.1 of @chatunity/baileys until a fixed version is released. As a mitigation, users can audit and pin dependencies to fixed commit SHAs or use only dependencies from trusted registries with integrity verification. Monitor the vendor or package repository for updates or official advisories.