MAL-2026-18491: Malicious code in @corexium/xbails (npm)

Published Nov 3, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729) package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag: "libsignal": "npm:@bellaxchuu/libsignal-node@latest". The code imports 'libsignal' at module load time for end-to-end-encryption primitives (SessionCipher, SessionRecord, ProtocolAddress, SessionBuilder in lib/Signal/libsignal.js and lib/Signal/curve.js). Each install resolves whatever the owner of @bellaxchuu/libsignal-node has published to @latest, with no version pin, no integrity check, and no provenance tie to the upstream libsignal-node project. The maintainer of the aliased fork therefore controls arbitrary code that runs at require/import time of this package, including inside the cryptographic session-handling path.

Affected Software

1 affected component

npm/@corexium/xbails=0.0.7

Event History

Nov 3, 2026

Advisory Published

via OSV·03:35 AM

Data Sourced

via OSV·03:35 AM

DescriptionAffected Software

Frequently Asked Questions

What makes installations of this package exposed to arbitrary code execution?

Its dependency alias resolves libsignal to @bellaxchuu/libsignal-node@latest rather than a fixed version. The owner of that package can change the mutable latest dist-tag, and the selected code runs when libsignal is imported.

When would the untrusted dependency code run?

The package imports libsignal at module load time in its Signal-related code. This places the untrusted code in the end-to-end encryption session-handling path, including use of SessionCipher, SessionRecord, ProtocolAddress, and SessionBuilder.

What configuration or supply-chain controls are missing?

The alias has no version pin, integrity check, or provenance tie to the upstream libsignal-node project. Each installation can therefore resolve to whatever version is currently assigned to the third-party package's latest dist-tag.

MAL-2026-18491: Malicious code in @corexium/xbails (npm)

Affected Software

Event History

Frequently Asked Questions

What makes installations of this package exposed to arbitrary code execution?

When would the untrusted dependency code run?

What configuration or supply-chain controls are missing?

Company

Resources

Contact

Frequently Asked Questions

What makes installations of this package exposed to arbitrary code execution?

When would the untrusted dependency code run?

What configuration or supply-chain controls are missing?