The libsignal-node-travatiger npm package, specifically versions 1.0.0 and 1.0.1, is malicious. When required, it schedules an install script that locates the @whiskeysockets/baileys package in the node_modules hierarchy and overwrites its lib/Socket/newsletter.js file with an attacker-controlled version. This patch is made persistent and idempotent by dropping a cache marker. The malicious replacement uses the installer's authenticated WhatsApp session to silently follow channels specified by a mutable JSON file hosted on GitHub, allowing the attacker to dynamically change targets or response logic without republishing the npm package. This attack involves tampering with trusted sibling package code, persistence beyond the malicious package's own directory, and abuse of authenticated WhatsApp sessions. The package name and description impersonate a legitimate library to lure victims. The compromise is severe enough that any system with this package installed should be considered fully compromised.

Systems with this package installed are fully compromised. The attacker gains persistent code execution by modifying trusted package files outside the malicious package's own directory. The attacker can silently abuse the installer's authenticated WhatsApp session to follow arbitrary channels controlled by the attacker, potentially enabling further malicious activities or information leakage. Because the attacker controls a mutable GitHub-hosted channel list and response logic, the attack can evolve dynamically without republishing the package. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a clean environment.

No official patch or fix is currently available. The malicious package should be removed immediately. Due to the severity of the compromise and persistence mechanisms, the affected system should be considered fully compromised. All secrets and keys stored on the system must be rotated from a different, uncompromised device. Monitor for any use of the @whiskeysockets/baileys package and verify its integrity. Avoid installing packages that impersonate legitimate libraries and verify package authenticity before use.