The npm package @axo_cuy/baileys version 1.0.0 declares a hard dependency on an off-registry GitHub repository (github:tenka-san/libsignal-node) without version pinning or integrity checks. This allows the third-party repository owner to change the code at any time, potentially introducing malicious code during installation. The dependency bypasses npm registry review and dependency pinning, increasing the risk of supply chain compromise.