The npm package @corexium/xbails version 0.0.7 imports a third-party package '@bellaxchuu/libsignal-node' using a mutable '@latest' tag without version pinning or integrity checks. This allows the maintainer of the aliased fork to execute arbitrary code at module load time, including within cryptographic session handling.