Critical Malicious Code Vulnerability in libsignal-skyzopedia Package
Summary
MAL-2026-1071: Malicious code in libsignal-skyzopedia (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libsignal-skyzopedia is an npm package designed for specific functionalities within the Signal ecosystem. It is utilized by developers to integrate features related to secure messaging. However, this package has been identified as containing malicious code, posing significant risks to any system where it is installed. The vulnerability allows unauthorized access and control over the affected systems, making it imperative for users to take immediate action.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the libsignal-skyzopedia package. This code can compromise any computer that has the package installed, leading to potential data breaches and unauthorized access to sensitive information. The ramifications are severe, as all secrets and keys stored on the compromised computer should be considered at risk. The malicious nature of the code is classified under CWE-506, indicating that it contains embedded malicious code, which can lead to complete control of the affected system by an outside entity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall libsignal-skyzopediaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, ensure that all secrets and keys stored on the affected computer are rotated immediately from a different, secure computer. This step is essential to mitigate the risks associated with the compromised system.
Conclusion
The libsignal-skyzopedia package has been identified as containing malicious code that poses significant risks to any system it is installed on. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for libsignal-skyzopedia →
FAQ
libsignal-skyzopedia is an npm package used for functionalities related to secure messaging within the Signal ecosystem.
The malicious code can compromise your system, allowing unauthorized access and control, which can lead to data breaches.
You should immediately remove the libsignal-skyzopedia package and rotate any sensitive information stored on the affected system.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Vulert is a tool that uses package-lock.json to monitor and alert for open-source vulnerabilities in your software, ensuring you stay informed about potential risks.
