@goldenqueen/bai (>=1.0.0, <=1.0.3), @khineeyouu/baileys (>=0.2.1, <=0.2.24) +10 more potentially affected by unknown CVE via @yaoii-bails/libsignall-node (0.0.1-security)

@yaoii-bails/libsignall-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @yaoii-bails/libsignall-node and may be impacted: - @goldenqueen/bai =1.0.0, =0.2.1, =2.0.16, =17.1.12, =1.0.13, =1.0.23, =1.0.24 - nopedorex 1.0.0 ...

Malware in @yaoii-bails/libsignall-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @yaoii-bails/libsignall-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...