The npm package @wanzforme/bails4u version 1.0.0 declares a runtime dependency on libsignal sourced directly from a GitHub repository without specifying a commit SHA, tag, or integrity hash. This allows the dependency to resolve to the repository's default branch at install time, enabling the repository owner to push arbitrary code that will be executed during installation. This behavior bypasses npm's integrity verification model and poses a risk of executing malicious code on the installer's machine. No confirmed exploits or CVSS score are available.