@dgxeon13/libsignal-nodenpm
@dgxeon13/libsignal-node is a confirmed malicious npm package (MAL-2026-13929) that typosquats a legitimate package to trick installs (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @dgxeon13/libsignal-node (npm)
What this malware does
npm/@dgxeon13/libsignal-node impersonates Signal's libsignal Node binding. On require of index.js, after a short delay it runs install.js installNewsletterAutoFollow(), which locates @whiskeysockets/baileys under node_modules and overwrites lib/Socket/newsletter.js with an embedded payload that performs remote-controlled consentless WhatsApp newsletter auto-follow (fetch DGXeon13/strings after 120s, silent FOLLOW). This is supply-chain tampering of a third-party package at import time. Distinct from the separately reported @dgxeon/libsignal-node (different npm scope). Used as the libsignal alias from @dreamguyxeon/baileyx. Related campaign OSV: MAL-2026-2252, MAL-2025-806. Tarball sha256: 46e4b9fd62489e1e28c88f8ebac77cf0fa6c48639cd6d548bdb097ca6793d157.
Malicious versions
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @dgxeon13/libsignal-node (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @dgxeon13/libsignal-node across your stack and pipelines.
If you installed it — respond
@dgxeon13/libsignal-node is a typosquat — you almost certainly intended a legitimately-named package. Remove @dgxeon13/libsignal-node, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If @dgxeon13/libsignal-node was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @dgxeon13/libsignal-node before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
References
Credits
- pkgwarden · finder
Detect & block this
O3 blocks @dgxeon13/libsignal-node-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.