Critical Malicious Code Vulnerability in @xayz/libsignal-node Package
Summary
MAL-2026-17672: Malicious code in @xayz/libsignal-node (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @xayz/libsignal-node package is an npm library designed for implementing the Signal Protocol, which is used for secure messaging. It provides functionalities for end-to-end encryption, ensuring that messages are only readable by the intended recipients. However, this package has been identified as containing malicious code, posing significant security risks to any application that utilizes it.
Vulnerability Detail
The vulnerability originates from the presence of embedded malicious code within the @xayz/libsignal-node package. Any system running this package is considered fully compromised, as it may allow unauthorized access to sensitive information, including secrets and keys stored on the affected computer. The malicious code can lead to severe ramifications, including data breaches and loss of control over the system. Users are advised to treat any installation of this package with extreme caution.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @xayz/libsignal-nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no direct workaround to mitigate the effects of the malicious code, the only recommended action is to uninstall the package and secure the system. Regularly monitor your systems for any unusual activity and consider using tools like Vulert to keep track of vulnerabilities in your dependencies.
Conclusion
The @xayz/libsignal-node package has been identified as containing malicious code, posing serious security risks. Immediate action is required to uninstall the package and secure any sensitive information. Regular monitoring of dependencies is essential to prevent future vulnerabilities.
See every vulnerability recorded for @xayz/libsignal-node →
FAQ
It is an npm library for implementing the Signal Protocol, used for secure messaging and end-to-end encryption.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
You should uninstall the package immediately and rotate any secrets or keys stored on the affected system.
No, there is currently no patched version of the @xayz/libsignal-node package available.
You can use Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities. You can also check your application using the Vulert playground without any signup.
