Malicious code in @itsmee_aizat.id/baileys2 (npm)

The @itsmee_aizat.id/baileys2 npm package declares a runtime dependency on a GitHub repository (tenka-san/libsignal-node) unrelated to the package publisher and the upstream Baileys project. This dependency is resolved to the current HEAD without commit SHA, tag, or integrity checks, enabling arbitrary code execution during installation and at runtime. The malicious code is loaded via the package's lib/Signal/libsignal.js file. The package also performs read-only version probes to legitimate sources, but these do not affect the compromise. Any system with this package installed or running should be considered fully compromised.

Full system compromise is possible on any computer with this package installed or running. Attackers controlling the tenka-san/libsignal-node repository can execute arbitrary code, potentially accessing all secrets and keys stored on the compromised machine. Immediate rotation of all secrets and keys from a separate, trusted machine is required. Removing the package alone does not guarantee removal of all malicious software introduced.

Remove the @itsmee_aizat.id/baileys2 package immediately from all affected systems. Rotate all secrets and keys that were stored or used on compromised machines from a different, secure environment. Since the malicious code is loaded at runtime from an external GitHub repository without integrity verification, avoid installing packages with unverified external dependencies. Patch status is not confirmed; check the vendor advisory for updates. Treat affected systems as fully compromised.