Malicious npm package @corexium/xbails aliases libsignal to attacker-controlled fork
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub Advisory Database (via OpenSSF/amazon-inspector) flagged npm package @corexium/xbails@0.0.7 as malicious. Its package.json aliases the import name 'libsignal' to the third-party package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag, with no version pin, integrity check, or provenance tie to upstream libsignal-node. The package imports libsignal at module load time for E2E-encryption primitives (SessionCipher, SessionRecord, ProtocolAddress, SessionBuilder in lib/Signal/libsignal.js and curve.js), so the fork's maintainer controls arbitrary code executed at require/import time, including in the cryptographic session-handling path. Any project installing @corexium/xbails 0.0.7 is exposed. No patched version exists; the package is malware and should be removed.
What to do
- Remove @corexium/xbails from all dependencies and lockfiles immediately
- Audit installs of version 0.0.7 for compromise; rotate secrets and keys on affected machines
- Check whether @bellaxchuu/libsignal-node is present in node_modules or lockfiles and remove it
- Pin all npm aliases to exact versions with integrity hashes; avoid @latest dist-tags
- Block these packages in registry proxies and CI dependency scanning
Sources
All live incidents on Threat Watch
