Malicious code in @neroxkira/vangal-baileys (npm)

Source: amazon-inspector 6af1543fb92f079191de134bd36dbb64c340928804df8486acf43546e2c6e185 package.json declares libsignal with the source github:RILLYZY/libsignal-node, an unpinned reference to a third-party GitHub repository with no tag or commit SHA. On npm install, npm clones that repository's...