Malicious npm packages @lynnidoffc/baileys and @lynnidoffc/libsignal-node — full system compromise on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
On 2026-11-03 GitHub published two malware advisories (GHSA-p6q5-8756-2mv7, GHSA-364q-2fx8-p97q) for the npm packages @lynnidoffc/baileys and @lynnidoffc/libsignal-node, which appear to be typosquat-style malicious imitations of the popular Baileys WhatsApp library and its libsignal dependency. All versions (= 0) are affected, with no patched versions available. The packages contain embedded malicious code (CWE-506); GitHub warns that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Reach appears limited (~82 downloads/month for baileys). Removal of the package does not guarantee removal of all malicious software. No fix exists; affected machines must be treated as compromised.
What to do
- Immediately remove @lynnidoffc/baileys and @lynnidoffc/libsignal-node from all systems and dependency trees
- Rotate all secrets, keys, and credentials stored on affected machines from a clean computer
- Rebuild/reimage affected machines; do not assume removal of the package removed the malware
- Audit install and CI logs for any use of these packages and check for persistence mechanisms
- Block the packages and publisher scope in npm registries and dependency firewalls
Sources
All live incidents on Threat Watch
