Malicious code in @kxafunc/xbails (npm)

The @kxafunc/xbails npm package version 0.0.8 uses a package.json alias to resolve its libsignal dependency to npm:@bellaxchuu/libsignal-node@latest, a non-standard publisher. This alias uses the mutable 'latest' dist-tag with no version pinning, no integrity verification, and no hash, meaning that on every install, the resolved module can change. The resolved module is loaded by critical Signal E2E encryption components (SessionCipher, SessionBuilder, ProtocolAddress, SessionRecord) that handle sensitive cryptographic material including identity keys and plaintext messages. Control over the upstream package name @bellaxchuu/libsignal-node allows an attacker to inject arbitrary code into every installation, executing within the encryption/decryption path and compromising the security guarantees of Signal's cryptography. This vulnerability arises from an off-registry trust relationship embedded in the manifest itself, independent of the current contents of the alias target.

An attacker controlling the upstream package @bellaxchuu/libsignal-node can execute arbitrary code within the Signal end-to-end encryption process of @kxafunc/xbails version 0.0.8. This can lead to compromise of identity keys, prekeys, and plaintext messages, effectively breaking the confidentiality and integrity of encrypted communications relying on this package.

No official patch or remediation is indicated in the provided data. Users should avoid using @kxafunc/xbails version 0.0.8 due to its reliance on a mutable alias to an untrusted upstream package. Until a fix is available, do not install or update this package. Monitor the vendor advisory or package repository for updates that remove the mutable alias and implement version pinning and integrity checks.