MalwarePublished 10 Aug 2026Updated 29 Oct 2026

@dreamguyxeon/libsignal-node (npm) · Malicious Code

Affects @dreamguyxeon/libsignal-nodeSource GCVE Database

Malicious package : remove @dreamguyxeon/libsignal-node and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:35 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13931

What to do

Remove @dreamguyxeon/libsignal-node from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@dreamguyxeon/libsignal-node	Affected 1.0.1 – 1.0.4 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

@dreamguyxeon/libsignal-node is a malicious npm package that performs supply-chain tampering by overwriting a dependency's source code to inject remote-controlled code. Upon import, it patches the @whiskeysockets/baileys library to silently make the host's authenticated WhatsApp session auto-follow attacker-chosen channels. The injected code fetches a mutable JSON from a personal GitHub repository, allowing the attacker to arbitrarily control newsletter operations on compromised systems. The package forcibly terminates the host process shortly after installation, and the tampering is persistent and idempotent. Systems with this package installed should be considered fully compromised.

Impact

Any system with this package installed is fully compromised. The attacker gains the ability to control the victim's WhatsApp session to auto-follow channels silently, potentially enabling further malicious operations. The attacker can update the remote payload at any time to change or escalate the malicious behavior. Because the package forcibly terminates the host process and maintains persistent tampering, it disrupts normal operations and makes detection and removal difficult. All secrets and keys stored on compromised systems are at risk and should be rotated immediately from a separate, clean device.

Defensive guidance

Remove the @dreamguyxeon/libsignal-node package immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a secure, uncompromised environment. Because the malicious code forcibly terminates the host process and maintains persistent tampering, a full system audit and potential rebuild may be necessary to ensure complete remediation. Monitor for any unauthorized WhatsApp activity linked to compromised accounts.

Summary

The npm package @dreamguyxeon/libsignal-node masquerades as a Signal protocol implementation but contains no legitimate Signal functionality. Instead, it schedules an installation script that locates the @whiskeysockets/baileys module in the host environment and overwrites its lib/Socket/newsletter.js file with malicious code. This replacement code fetches a remote JSON file from a mutable GitHub repository and uses it to silently cause the host's WhatsApp session to auto-follow attacker-specified channels without user consent. The package also drops a marker file to maintain persistence and forcibly terminates the host process 20 seconds after installation. Because the remote JSON is unauthenticated and mutable, the attacker retains ongoing control over the compromised WhatsApp sessions and can change the malicious behavior at will. This supply-chain attack affects versions 1.0.1, 1.0.2, 1.0.3, and 1.0.4 of the package. The compromise is severe enough that all secrets and keys on affected systems should be rotated from a clean environment.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:35 UTC

Technical details

References

Community reviews