Malicious npm packages: @fadelsm/libsignal-node and @fadelsm/baileys — typosquat malware compromises hosts (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
GitHub's advisory database published two malware advisories on 2026-11-11 covering npm packages @fadelsm/libsignal-node and @fadelsm/baileys, both classified CWE-506 (embedded malicious code) with critical severity. Every version (= 0) is affected and no patched versions exist. The packages appear to be typosquats of the legitimate libsignal and Baileys (WhatsApp) libraries. Any machine with the packages installed or running must be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of the malicious software. Downloads are low (~46/month for libsignal-node), limiting reach, but any installer is a victim. There is no fix — the packages must be removed and all secrets on affected hosts rotated from a clean machine.
What to do
- Immediately uninstall @fadelsm/libsignal-node and @fadelsm/baileys from all projects and machines
- Treat affected machines as fully compromised: rebuild/reimage them
- Rotate all secrets, keys, and credentials stored on affected machines from a different, clean computer
- Audit dependency lockfiles and CI caches for the packages and block them in registry allowlists
- Review logs for signs of attacker access or exfiltration after installation
Sources
All live incidents on Threat Watch
