GCVE-110-OSM-2026-12378

package.json redirects the `libsignal` dependency to `npm:@otaxayun/libsignal-node@latest`. The `@latest` dist-tag is mutable and unpinned, so each `npm install` of zero-baileys resolves whatever tarball the `@otaxayun` scope currently publishes and executes any lifecycle scripts (preinstall/install/postinstall) it contains. Upstream Baileys resolves libsignal from a pinned source; the alias here substitutes an unofficial third-party scope as the trust root for a core cryptographic dependency, with no version pin and no integrity check. We have flagged this package as suspicious for a number of reasons including several of the Telegram users affiliated with this package are known threat actors. No existing payload in this package right now, but we are flagging it as an INFO. ENTRY engine-requirements.js (install-hook: node ./engine-requirements.js) - Install Hook Executes Local JS File in package.json PERSISTENCE - Startup Persistence in lib/Store/make-in-memory-store.js: ".profile" - Startup Persistence in lib/assets/wasm/worker-modules.js: ".profile" DESTINATION - 10 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/Socket/socket.js: "Buffer.from(creds.noiseKey.public).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/chat-utils.js: "Buffer.from(indexMac).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/messages-media.js: "Buffer.from(media.fileSha256).toString('base64')" - Data Encoding for Exfiltration in lib/Utils/process-message.js: "Buffer.from(keyId.keyId).toString('base64')" - Data Encoding for Exfiltration in lib/assets/wasm/worker-modules.js: "encodeURIComponent(String(e))}).join("&")),n}l.default=s}),98" - Network Request in lib/Utils/messages-media.js: "https.request(" OBFUSCATION - Global Variable Shadowing in lib/VoIP/wasm-engine.js: "const module = {" - Global Variable Shadowing in lib/VoIP/wasm-engine.js.bak: "const module = {" - Global Variable Shadowing in lib/VoIP/worker-bootstrap.js: "const module = {" - Dynamic Base64 Decoding in lib/Signal/Group/group_cipher.js: "Buffer.from(iv, 'base64')" - Dynamic Base64 Decoding in lib/Signal/Group/sender-key-state.js: "Buffer.from(chainKey, 'base64')" - Dynamic Base64 Decoding in lib/Socket/dugong.js: "Buffer.from(jpegThumbnail, 'base64')" - Dynamic Base64 Decoding in lib/Utils/chat-utils.js: "Buffer.from(keyId, 'base64')" - Dynamic Base64 Decoding in lib/Utils/generics.js: "Buffer.from(val, 'base64')" (+14 more) ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in lib/assets/wasm/worker-modules.js: "https://www.internalfb.com/intern/invariant/2/" - Platform Detection with Data Collection in lib/Socket/messages-recv.js: "JSON.stringify({ ...child, content: Buffer.isBuffer(child.content) ? child.conte..." - Shell Command Execution in lib/Socket/messages-send.js: "require('child_process')" - Dynamic Code Execution in lib/Utils/rich-messages.js: "exec(line)" - XOR-Encoded String Arrays in lib/assets/wasm/loader.js: "var r=[0,97,115,109,1,0,0,0,1]" PAYLOAD FILES lib/assets/wasm/worker-modules.js