@corexium/xbails@0.0.7

Summary

package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag: "libsignal": "npm:@bellaxchuu/libsignal-node@latest". The code imports 'libsignal' at module load time for end-to-end-encryption primitives (SessionCipher, SessionRecord, ProtocolAddress, SessionBuilder in lib/Signal/libsignal.js and lib/Signal/curve.js). Each install resolves whatever the owner of @bellaxchuu/libsignal-node has published to @latest, with no version pin, no integrity check, and no provenance tie to the upstream libsignal-node project. The maintainer of the aliased fork therefore controls arbitrary code that runs at require/import time of this package, including inside the cryptographic session-handling path.

Source: amazon-inspector (7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729)