noverojava

GHSA-g77m-jmph-gj8q

Malicious code in noverojava (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: amazon-inspector (a7fbf0d1519b05868b34e9e2c1d3588a0596003a5cb53e4cd28fd3a856ecff26)
package.json declares the runtime dependency `libsignal` as `github:tenka-san/libsignal-node` rather than a registry version range or pinned commit SHA. On `npm install`, npm fetches the current HEAD of that fork's default branch and executes any lifecycle scripts it defines. The fork is under a third-party GitHub account (not the upstream WhiskeySockets libsignal-node maintainer), has no commit pin, and no integrity check, so whoever controls that account controls code that runs on the installer's machine at install time. The package presents as a Baileys/WhatsApp library fork; the static match on lib/Utils/generics.js line 403 (ping/GET tokens) is consistent with normal Baileys network code and is not independently indicative of exfiltration.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/39358a8292b2512d6ac0a00210489c0550399f2d/osv/malicious/npm/noverojava/MAL-2026-16389.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/39358a8292b2512d6ac0a00210489c0550399f2d/osv/malicious/npm/noverojava/MAL-2026-16389.json
- https://www.npmjs.com/package/noverojava/v/1.0.9
- https://www.npmjs.com/package/noverojava/v/1.1.0
- https://github.com/advisories/GHSA-g77m-jmph-gj8q

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.