MalwarePublished 23 Jun 2026Updated 9 Jul 2026

libsignal-node-travatiger (npm) · Malicious Code

Affects libsignal-node-travatigerSource GCVE Database

Malicious package : remove libsignal-node-travatiger and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:05 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6281

What to do

Remove libsignal-node-travatiger from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmlibsignal-node-travatiger	Affected =1.0.0 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package libsignal-node-travatiger (versions 1.0.0 and 1.0.1) contains malicious code that, upon installation, modifies a sibling trusted package's source code to persistently inject attacker-controlled behavior. This behavior abuses the installer's authenticated WhatsApp session to silently follow attacker-chosen channels, with the channel list hosted on a mutable GitHub repository allowing dynamic control by the attacker. The package impersonates a legitimate Signal Protocol library to deceive users. Installation of this package results in full system compromise, requiring immediate secret and key rotation from a clean system.

Impact

Systems with this package installed are fully compromised. The attacker gains persistent code execution by modifying trusted package files outside the malicious package's own directory. The attacker can silently abuse the installer's authenticated WhatsApp session to follow arbitrary channels controlled by the attacker, potentially enabling further malicious activities or information leakage. Because the attacker controls a mutable GitHub-hosted channel list and response logic, the attack can evolve dynamically without republishing the package. All secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a clean environment.

Defensive guidance

The malicious package should be removed immediately. Due to the severity of the compromise and persistence mechanisms, the affected system should be considered fully compromised. All secrets and keys stored on the system must be rotated from a different, uncompromised device. Monitor for any use of the @whiskeysockets/baileys package and verify its integrity. Avoid installing packages that impersonate legitimate libraries and verify package authenticity before use.

Summary

The libsignal-node-travatiger npm package, specifically versions 1.0.0 and 1.0.1, is malicious. When required, it schedules an install script that locates the @whiskeysockets/baileys package in the node_modules hierarchy and overwrites its lib/Socket/newsletter.js file with an attacker-controlled version. This patch is made persistent and idempotent by dropping a cache marker. The malicious replacement uses the installer's authenticated WhatsApp session to silently follow channels specified by a mutable JSON file hosted on GitHub, allowing the attacker to dynamically change targets or response logic without republishing the npm package. This attack involves tampering with trusted sibling package code, persistence beyond the malicious package's own directory, and abuse of authenticated WhatsApp sessions. The package name and description impersonate a legitimate library to lure victims. The compromise is severe enough that any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:05 UTC

Technical details

References

Community reviews