Malicious code in @lekzo/baileys (npm)

The @lekzo/baileys npm package versions 0.0.1 and 0.0.7 specify the libsignal dependency as github:canove/libsignal-node without a commit SHA, tag, or semantic version. This means that on npm install, the dependency resolves to the latest commit on the GitHub repository, allowing arbitrary code to be fetched and executed without integrity verification. Control of the GitHub repository by an attacker enables execution of malicious code on any system installing this package. The package is considered fully compromised once installed, with potential full system compromise.

Systems with @lekzo/baileys versions 0.0.1 or 0.0.7 installed are at risk of full compromise due to arbitrary code execution from the uncontrolled GitHub dependency. Attackers controlling the dependency repository can execute any code during installation, potentially stealing secrets and keys. The compromise is severe enough that all secrets and keys on affected systems should be rotated immediately from a separate, trusted machine. Removing the package does not guarantee removal of all malicious artifacts.

Remove the affected versions of the @lekzo/baileys package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Avoid installing packages that depend on GitHub repositories without fixed commit SHAs, tags, or versions to prevent arbitrary code execution. Monitor for updates or official advisories from the package maintainers regarding fixes or safer dependency declarations. Patch status is not confirmed; check vendor advisories for any official fixes.