@wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
GitHub Advisory Database (GHSA-38gh-x97r-9cx2, published 2026-11-13) flags the npm package @wanzforme/bails4u version 1.0.0 as malicious code (CWE-506), sourced from Amazon Inspector analysis. The package's package.json declares a runtime dependency on libsignal from github:wanzchil/libsignal-node with no commit SHA, tag, or integrity hash. npm install therefore resolves whatever the repository's default branch currently contains and executes its lifecycle scripts on the installer's machine; the repo owner can push new commits at any time, so future installs fetch and run unverified bytes, bypassing the npm registry's integrity model. A separate static match in lib/Utils/generics.js (ping/HTTP pattern) is consistent with WhatsApp/Baileys-style utilities and not independently indicative of malice. No patched versions exist; the package is malware and should be removed, not updated.
What to do
- Remove @wanzforme/bails4u from all projects and lockfiles; do not attempt to upgrade
- Audit install logs and CI systems for any installs of the package and investigate machines that ran them for compromise (lifecycle scripts executed)
- Rotate credentials, tokens, and secrets accessible from affected build/developer environments
- Pin all GitHub-referenced dependencies to commit SHAs with integrity verification and reject unpinned git dependencies in policy
- Scan environments for indicators tied to wanzchil/libsignal-node and block the repository/dependency
Sources
All live incidents on Threat Watch
