GCVE-110-OSM-2026-8163

This package impersonates Open Whisper Systems' libsignal-node but is published by a brand-new account (dilxzphrine, zero prior packages, no repository) and executes covert behavior on import. The entrypoint index.js explicitly calls `require('./install').installNewsletterAutoFollow()` via a 1-second setTimeout immediately on module load — a deliberate delay to evade synchronous analysis. The install.js file contains encoded/obfuscated content that resisted both deobfuscation tools (one timed out, one produced no changes), strongly suggesting intentional evasion. The package also declares a dependency on the npm package 'fs', which is separately flagged as malicious in OSM and has confirmed reports as a malicious package. The attacker model is a supply chain attack: a developer importing what they believe is the Signal protocol library silently triggers a covert secondary payload whose purpose is obscured by failed deobfuscation. ENTRY index.js (main: index.js) OBFUSCATION - Dynamic Base64 Decoding in install.js: "Buffer.from(encodedJid, 'base64')" - Dynamic Base64 Decoding in src/session_record.js: "Buffer.from(k, 'base64')" - Decoded Base64 Content in install.js (x2) - Strings Extracted from Deobfuscated Code in src/session_record.js - Deobfuscation Failed in install.js ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json PAYLOAD FILES install.js INDICATORS (IOCs) - domains: KeyExchangeMessage.prototype.id - payloadFileHash: c1e9b132cc4e76acbbe2225a1f434c6f26c3e5c0c3739fe357d75949e5615485